Add information about CORs, protected assets should be in their own blob

Author: wilr

README.md

@@ -11,7 +11,14 @@ local filesystem. This leverages Flysystem in Silverstripe 4.
 The module requires a few environment variables to be set
 
 * `AZURE_CONNECTION_URL`: The connection URL as from the dashboard
-* `AZURE_CONTAINER_NAME`: The name of the container to store assets in.
+* `AZURE_CONTAINER_NAME`: The name of the container to store public assets in.
+* `AZURE_PROTECTED_CONTAINER_NAME`: The name of the container for protected
+assets
+
+By default the module will serve public files from the URL provided in
+`AZURE_CONNECTION_URL` (e.g silverstripe-assets.blob.core.windows.net) unless
+ `AZURE_PUBLIC_BLOB_DOMAIN` is set. Protected assets are always served from the
+ local domain and routed through the permission checking.
 
 ## Installation
 
@@ -32,4 +39,7 @@ directly accessed.
 
 The module supports this by streaming the contents of protected files down to the browser
 via the web server (as opposed to linking directly) by default. To ensure that
-protected assets can't be accessed, ensure you setup an appropriate policy.
+protected assets can't be accessed, ensure you setup an appropriate policy.
+
+## CORS
+

_config/assets.yml

@@ -14,6 +14,7 @@ SilverStripe\Core\Injector\Injector:
     constructor:
       connectionUrl: '`AZURE_CONNECTION_URL`'
       containerName: '`AZURE_CONTAINER_NAME`'
+      assetDomain: '`AZURE_CONTAINER_NAME`'
   League\Flysystem\Cached\Storage\Memory.public:
     class: League\Flysystem\Cached\Storage\Memory
   League\Flysystem\Cached\Storage\Adapter.public:
@@ -30,7 +31,7 @@ SilverStripe\Core\Injector\Injector:
   FullscreenInteractive\SilverStripe\AzureStorage\Adapter\ProtectedAdapter:
     constructor:
       connectionUrl: '`AZURE_CONNECTION_URL`'
-      containerName: '`AZURE_CONTAINER_NAME`'
+      containerName: '`AZURE_PROTECTED_CONTAINER_NAME`'
   League\Flysystem\Cached\Storage\Adapter.protected:
       class: League\Flysystem\Cached\Storage\Adapter
       constructor:

src/Adapter/ProtectedAdapter.php

@@ -2,10 +2,9 @@
 
 namespace FullscreenInteractive\SilverStripe\AzureStorage\Adapter;
 
-use Exception;
+use FullscreenInteractive\SilverStripe\AzureStorage\Service\BlobService;
 use InvalidArgumentException;
 use League\Flysystem\AzureBlobStorage\AzureBlobStorageAdapter;
-use MicrosoftAzure\Storage\Blob\BlobRestProxy;
 use SilverStripe\Assets\Flysystem\ProtectedAdapter as SilverstripeProtectedAdapter;
 use SilverStripe\Control\Controller;
 
@@ -28,7 +27,7 @@ public function __construct($connectionUrl = '', $containerName = '')
             throw new InvalidArgumentException("AZURE_CONTAINER_NAME environment variable not set");
         }
 
-        $client = BlobRestProxy::createBlobService($connectionUrl);
+        $client = BlobService::clientForConnection($connectionUrl);
 
         parent::__construct($client, $containerName);
     }

src/Adapter/PublicAdapter.php

@@ -2,15 +2,17 @@
 
 namespace FullscreenInteractive\SilverStripe\AzureStorage\Adapter;
 
+use FullscreenInteractive\SilverStripe\AzureStorage\Service\BlobService;
 use InvalidArgumentException;
 use League\Flysystem\AzureBlobStorage\AzureBlobStorageAdapter;
-use MicrosoftAzure\Storage\Blob\BlobRestProxy;
 use SilverStripe\Assets\Flysystem\PublicAdapter as SilverstripePublicAdapter;
 use SilverStripe\Control\Controller;
 
 class PublicAdapter extends AzureBlobStorageAdapter implements SilverstripePublicAdapter
 {
-    public function __construct($connectionUrl = '', $containerName = '')
+    private $assetDomain;
+
+    public function __construct($connectionUrl = '', $containerName = '', $assetDomain = '')
     {
         if (!$connectionUrl) {
             throw new InvalidArgumentException("AZURE_CONNECTION_URL environment variable not set");
@@ -20,7 +22,15 @@ public function __construct($connectionUrl = '', $containerName = '')
             throw new InvalidArgumentException("AZURE_CONTAINER_NAME environment variable not set");
         }
 
-        $client = BlobRestProxy::createBlobService($connectionUrl);
+        $client = BlobService::clientForConnection($connectionUrl);
+
+        if ($assetDomain) {
+            $this->assetDomain = $assetDomain;
+        } else {
+            $this->assetDomain = (string) BlobService::getClient()
+                ->getPsrPrimaryUri()
+                ->withPath($containerName);
+        }
 
         parent::__construct($client, $containerName);
     }
@@ -32,10 +42,14 @@ public function __construct($connectionUrl = '', $containerName = '')
      */
     public function getPublicUrl($path)
     {
-        if ($meta = $this->getMetadata($path)) {
-            return Controller::join_links(ASSETS_DIR, $meta['path']);
+        $parts = explode('/', $path);
+
+        if (isset($parts[0]) && $parts[0] === ASSETS_DIR) {
+            array_shift($parts);
         }
 
-        return '';
+        $path = implode('/', $parts);
+
+        return Controller::join_links($this->assetDomain, $path);
     }
 }

src/Service/BlobService.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace FullscreenInteractive\SilverStripe\AzureStorage\Service;
+
+use MicrosoftAzure\Storage\Blob\BlobRestProxy;
+
+class BlobService
+{
+    private static $client;
+
+    private static $connectionUrl;
+
+    public static function clientForConnection($connectionUrl)
+    {
+        if (!self::$connectionUrl || self::$connectionUrl !== $connectionUrl) {
+            self::$connectionUrl = $connectionUrl;
+            self::$client = BlobRestProxy::createBlobService($connectionUrl);
+        }
+
+        return self::$client;
+    }
+
+    public static function getClient()
+    {
+        return self::$client;
+    }
+}