From 9b4e42018e90d95bc0d46cfe970859ee82386146 Mon Sep 17 00:00:00 2001
From: Alberto Bellotti <abellotti@users.noreply.github.com>
Date: Thu, 18 Oct 2018 16:14:04 -0400
Subject: [PATCH] Merge pull request #495 from jvlcek/bz_1599259_CORS

Add subcollection options support for CORS prefilghted requests

(cherry picked from commit 3502e51181ce92c28866a4626fdfadf0d31bd591)

https://bugzilla.redhat.com/show_bug.cgi?id=1599259
---
 app/controllers/api/base_controller.rb | 6 +++++-
 config/routes.rb                       | 3 +++
 spec/requests/tenant_quotas_spec.rb    | 6 ++++++
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/app/controllers/api/base_controller.rb b/app/controllers/api/base_controller.rb
index 9f80d40eac..06a74db8ed 100644
--- a/app/controllers/api/base_controller.rb
+++ b/app/controllers/api/base_controller.rb
@@ -103,7 +103,11 @@ def destroy
     end
 
     def options
-      render_options(@req.collection)
+      if params.key?(:subcollection)
+        render :json => ""
+      else
+        render_options(@req.collection)
+      end
     end
 
     def settings
diff --git a/config/routes.rb b/config/routes.rb
index 9173e23d52..de03a74a84 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -53,6 +53,9 @@
         end
 
         Array(collection.subcollections).each do |subcollection_name|
+          # OPTIONS action for each subcollection
+          match "/:c_id/#{subcollection_name}", :controller => collection_name, :action => :options, :via => :options, :as => nil, :subcollection => true
+
           if subcollection_name == :settings
             match(
               "/:c_id/settings",
diff --git a/spec/requests/tenant_quotas_spec.rb b/spec/requests/tenant_quotas_spec.rb
index 14ea5c2062..4142e8cbba 100644
--- a/spec/requests/tenant_quotas_spec.rb
+++ b/spec/requests/tenant_quotas_spec.rb
@@ -131,6 +131,12 @@
       expect(response).to have_http_status(:no_content)
     end
 
+    it "supports OPTIONS requests on a subcollection without authorization" do
+      options api_tenant_quotas_url(nil, tenant)
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to be_empty
+    end
+
     it "can delete multiple quotas from a tenant with POST" do
       api_basic_authorize action_identifier(:quotas, :delete, :subcollection_actions, :post)