-
Notifications
You must be signed in to change notification settings - Fork 201
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(sdk): cors support for api resource (#2904)
Based on [this spec](https://docs.winglang.io/contributors/rfcs/2023-01-20-wingsdk-spec#api). Work in progress, only focusing simulator target right now. - [x] Simulator - [x] tf-aws - [x] tests - [x] something like `cors: true` to do some sort of catch all cors handling Open questions: - ~How to inject cors handlers in other targets than `sim`~ Outscoped: - [ ] individual route handling - [ ] limit auto added cors handler to valid routes (maybe not that important) - [ ] probably needs [max age](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age) header Fixes #2289 ## Checklist - [ ] Title matches [Winglang's style guide](https://docs.winglang.io/contributors/pull_requests#how-are-pull-request-titles-formatted) - [ ] Description explains motivation and solution - [ ] Tests added (always) - [ ] Docs updated (only required for features) - [ ] Added `pr/e2e-full` label if this feature requires end-to-end testing *By submitting this pull request, I confirm that my contribution is made under the terms of the [Monada Contribution License](https://docs.winglang.io/terms-and-policies/contribution-license.html)*.
- Loading branch information
Showing
49 changed files
with
4,713 additions
and
272 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,7 @@ | ||
| node_modules/ | ||
|
|
||
| .pnpm-store/ | ||
|
|
||
| # Terraform state files | ||
| *.tfstate | ||
| *.tfstate.* | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| bring cloud; | ||
| bring http; | ||
| bring util; | ||
|
|
||
| let api = new cloud.Api({ | ||
| cors: true | ||
| }); | ||
| let body = "ok!"; | ||
|
|
||
| api.get("/path", inflight (req) => { | ||
| return { | ||
| status: 200, | ||
| body: body | ||
| }; | ||
| }); | ||
|
|
||
| test "http.get and http.fetch can preform a call to an api" { | ||
| let url = api.url + "/path"; | ||
| let response = http.get(url); | ||
|
|
||
| assert(response.headers.get("access-control-allow-origin") == "*"); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| bring cloud; | ||
| bring ex; | ||
| bring http; | ||
| bring "./assertions.w" as t; | ||
|
|
||
| let api = new cloud.Api( | ||
| cors: true, | ||
| corsOptions: { | ||
| allowOrigin: ["winglang.io"], | ||
| allowMethods: [cloud.HttpMethod.GET, cloud.HttpMethod.POST, cloud.HttpMethod.OPTIONS], | ||
| allowHeaders: ["Content-Type", "Authorization", "X-Custom-Header"], | ||
| allowCredentials: true, | ||
| exposeHeaders: ["Content-Type"] | ||
| } | ||
| ); | ||
|
|
||
| api.get("/users", inflight (req) => { | ||
| return { | ||
| body: "hello world", | ||
| status: 200 | ||
| }; | ||
| }); | ||
|
|
||
| test "GET /users has cors headers" { | ||
| let response = http.get(api.url + "/users"); | ||
|
|
||
| let headers = response.headers; | ||
| t.Assert.equalNum(response.status, 200); | ||
|
|
||
| // GET cors headers are set | ||
| t.Assert.equalStr(headers.get("access-control-allow-origin"), "winglang.io"); | ||
| t.Assert.equalStr(headers.get("access-control-allow-credentials"), "true"); | ||
| t.Assert.equalStr(headers.get("access-control-expose-headers"), "Content-Type"); | ||
|
|
||
| // OPTIONS cors headers are not set | ||
| t.Assert.isNil(headers.get("access-control-allow-headers")); | ||
| t.Assert.isNil(headers.get("access-control-allow-methods")); | ||
| } | ||
|
|
||
| test "OPTIONS /users has cors headers" { | ||
| let response = http.fetch(api.url + "/users", { | ||
| method: http.HttpMethod.OPTIONS | ||
| }); | ||
|
|
||
| let headers = response.headers; | ||
|
|
||
| t.Assert.equalNum(response.status, 204); | ||
|
|
||
| // OPTIONS cors headers are set | ||
| t.Assert.equalStr(headers.get("access-control-allow-methods"), "GET,POST,OPTIONS"); | ||
| t.Assert.equalStr(headers.get("access-control-allow-headers"), "Content-Type,Authorization,X-Custom-Header"); | ||
| t.Assert.equalStr(headers.get("access-control-allow-origin"), "winglang.io"); | ||
|
|
||
| // Other cors headers are not set | ||
| t.Assert.isNil(headers.get("access-control-expose-headers")); | ||
| t.Assert.isNil(headers.get("access-control-allow-credentials")); | ||
| } | ||
|
|
||
| test "OPTIONS /users responds with proper headers for requested" { | ||
| let response = http.fetch(api.url + "/users", { | ||
| method: http.HttpMethod.OPTIONS, | ||
| headers: { | ||
| "Access-Control-Request-Method": "PUT", | ||
| "Access-Control-Request-Headers": "Content-Type,Authorization,X-Custom-Foo", | ||
| } | ||
| }); | ||
|
|
||
| let headers = response.headers; | ||
| t.Assert.equalNum(response.status, 204); | ||
| t.Assert.equalStr(headers.get("access-control-allow-methods"), "GET,POST,OPTIONS"); | ||
| t.Assert.equalStr(headers.get("access-control-allow-headers"), "Content-Type,Authorization,X-Custom-Header"); | ||
| t.Assert.equalStr(headers.get("access-control-allow-origin"), "winglang.io"); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| bring cloud; | ||
| bring ex; | ||
| bring http; | ||
| bring "./assertions.w" as t; | ||
|
|
||
| let apiDefaultCors = new cloud.Api( | ||
| cors: true | ||
| ); | ||
|
|
||
| apiDefaultCors.get("/users", inflight (req) => { | ||
| return { | ||
| body: "hello world", | ||
| status: 200 | ||
| }; | ||
| }); | ||
|
|
||
| test "GET /users has default cors headers" { | ||
| let response = http.get(apiDefaultCors.url + "/users"); | ||
|
|
||
| let headers = response.headers; | ||
| t.Assert.equalNum(response.status, 200); | ||
|
|
||
| // GET cors headers are set | ||
| t.Assert.equalStr(headers.get("access-control-allow-origin"), "*"); | ||
| t.Assert.equalStr(headers.get("access-control-allow-credentials"), "false"); | ||
| t.Assert.equalStr(headers.get("access-control-expose-headers"), ""); | ||
|
|
||
| // OPTIONS headers are not set | ||
| t.Assert.isNil(headers.get("access-control-allow-headers")); | ||
| t.Assert.isNil(headers.get("access-control-allow-methods")); | ||
| } | ||
|
|
||
| test "OPTIONS /users has default cors headers" { | ||
| let response = http.fetch(apiDefaultCors.url + "/users", { | ||
| method: http.HttpMethod.OPTIONS | ||
| }); | ||
|
|
||
| let headers = response.headers; | ||
| t.Assert.equalNum(response.status, 204); | ||
|
|
||
| // OPTIONS cors headers are set | ||
| t.Assert.equalStr(headers.get("access-control-allow-headers"), "Content-Type,Authorization,X-Requested-With"); | ||
| t.Assert.equalStr(headers.get("access-control-allow-methods"), "GET,POST,PUT,DELETE,HEAD,OPTIONS"); | ||
| t.Assert.equalStr(headers.get("access-control-allow-origin"), "*"); | ||
|
|
||
| // Other headers are not set | ||
| t.Assert.isNil(headers.get("access-control-allow-credentials")); | ||
| t.Assert.isNil(headers.get("access-control-expose-headers")); | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| inflight class Assert { | ||
| static equalStr(a: str, b: str): bool { | ||
| try { | ||
| assert(a == b); | ||
| } catch e { | ||
| throw("expected: ${b} got: ${a}"); | ||
| } | ||
| } | ||
|
|
||
| static isNil(a: str?): bool { | ||
| try { | ||
| assert(a == nil); | ||
| } catch e { | ||
| log(e); | ||
| throw("expected '${a}' to be nil"); | ||
| } | ||
| } | ||
|
|
||
| static equalNum(a: num, b: num): bool{ | ||
| try { | ||
| assert(a == b); | ||
| } catch e { | ||
| log(e); | ||
| throw("expected: ${b} got: ${a}"); | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.