Configure CORS headers from environment variables

2026-09-18 08:41:03 +00:00
parent bbd12ce674
commit 26464bce43
10 changed files with 313 additions and 5 deletions
@@ -81,5 +81,54 @@ class DatabaseUrlTests(unittest.TestCase):
        )


+class CorsSettingsTests(unittest.TestCase):
+    def test_cors_disabled_by_default(self):
+        settings = _settings({})
+        self.assertIsNone(settings.cors_allow_origins)
+        self.assertIsNone(settings.cors_allow_origin_regex)
+        self.assertIsNone(settings.cors_allow_methods)
+        self.assertIsNone(settings.cors_allow_headers)
+        self.assertFalse(settings.cors_allow_credentials)
+        self.assertIsNone(settings.cors_expose_headers)
+        self.assertEqual(600, settings.cors_max_age)
+
+    def test_allow_origins_parses_comma_separated_list(self):
+        settings = _settings({
+            "CORS_ALLOW_ORIGINS": "https://a.example, https://b.example ,,https://c.example",
+        })
+        self.assertEqual(
+            ("https://a.example", "https://b.example", "https://c.example"),
+            settings.cors_allow_origins,
+        )
+
+    def test_allow_origins_star_is_passed_through(self):
+        settings = _settings({"CORS_ALLOW_ORIGINS": "*"})
+        self.assertEqual(("*",), settings.cors_allow_origins)
+
+    def test_allow_origin_regex_is_passed_through(self):
+        settings = _settings({"CORS_ALLOW_ORIGIN_REGEX": r"https://.*\.example\.com"})
+        self.assertEqual(r"https://.*\.example\.com", settings.cors_allow_origin_regex)
+
+    def test_allow_methods_and_headers_parse_as_lists(self):
+        settings = _settings({
+            "CORS_ALLOW_METHODS": "GET,POST",
+            "CORS_ALLOW_HEADERS": "Authorization, X-Custom-Header",
+            "CORS_EXPOSE_HEADERS": "X-Total-Count",
+        })
+        self.assertEqual(("GET", "POST"), settings.cors_allow_methods)
+        self.assertEqual(("Authorization", "X-Custom-Header"), settings.cors_allow_headers)
+        self.assertEqual(("X-Total-Count",), settings.cors_expose_headers)
+
+    def test_allow_credentials_parses_boolean(self):
+        for value in ("1", "true", "TRUE", "yes", "on"):
+            self.assertTrue(_settings({"CORS_ALLOW_CREDENTIALS": value}).cors_allow_credentials)
+        for value in ("0", "false", "no", "off", "anything-else"):
+            self.assertFalse(_settings({"CORS_ALLOW_CREDENTIALS": value}).cors_allow_credentials)
+
+    def test_max_age_parses_int(self):
+        settings = _settings({"CORS_MAX_AGE": "3600"})
+        self.assertEqual(3600, settings.cors_max_age)
+
+
 if __name__ == "__main__":
    unittest.main()