Configure CORS headers from environment variables

server/tests/test_config.py

@@ -81,5 +81,54 @@ class DatabaseUrlTests(unittest.TestCase):
         )
 
 
+class CorsSettingsTests(unittest.TestCase):
+    def test_cors_disabled_by_default(self):
+        settings = _settings({})
+        self.assertIsNone(settings.cors_allow_origins)
+        self.assertIsNone(settings.cors_allow_origin_regex)
+        self.assertIsNone(settings.cors_allow_methods)
+        self.assertIsNone(settings.cors_allow_headers)
+        self.assertFalse(settings.cors_allow_credentials)
+        self.assertIsNone(settings.cors_expose_headers)
+        self.assertEqual(600, settings.cors_max_age)
+
+    def test_allow_origins_parses_comma_separated_list(self):
+        settings = _settings({
+            "CORS_ALLOW_ORIGINS": "https://a.example, https://b.example ,,https://c.example",
+        })
+        self.assertEqual(
+            ("https://a.example", "https://b.example", "https://c.example"),
+            settings.cors_allow_origins,
+        )
+
+    def test_allow_origins_star_is_passed_through(self):
+        settings = _settings({"CORS_ALLOW_ORIGINS": "*"})
+        self.assertEqual(("*",), settings.cors_allow_origins)
+
+    def test_allow_origin_regex_is_passed_through(self):
+        settings = _settings({"CORS_ALLOW_ORIGIN_REGEX": r"https://.*\.example\.com"})
+        self.assertEqual(r"https://.*\.example\.com", settings.cors_allow_origin_regex)
+
+    def test_allow_methods_and_headers_parse_as_lists(self):
+        settings = _settings({
+            "CORS_ALLOW_METHODS": "GET,POST",
+            "CORS_ALLOW_HEADERS": "Authorization, X-Custom-Header",
+            "CORS_EXPOSE_HEADERS": "X-Total-Count",
+        })
+        self.assertEqual(("GET", "POST"), settings.cors_allow_methods)
+        self.assertEqual(("Authorization", "X-Custom-Header"), settings.cors_allow_headers)
+        self.assertEqual(("X-Total-Count",), settings.cors_expose_headers)
+
+    def test_allow_credentials_parses_boolean(self):
+        for value in ("1", "true", "TRUE", "yes", "on"):
+            self.assertTrue(_settings({"CORS_ALLOW_CREDENTIALS": value}).cors_allow_credentials)
+        for value in ("0", "false", "no", "off", "anything-else"):
+            self.assertFalse(_settings({"CORS_ALLOW_CREDENTIALS": value}).cors_allow_credentials)
+
+    def test_max_age_parses_int(self):
+        settings = _settings({"CORS_MAX_AGE": "3600"})
+        self.assertEqual(3600, settings.cors_max_age)
+
+
 if __name__ == "__main__":
     unittest.main()

server/tests/test_cors.py

@@ -0,0 +1,129 @@
+"""Integration tests for the CORS configuration in :mod:`tavolo.app`.
+
+The mixin under test is kaya-cors' :class:`~kaya.cors.CorsMixin`; these
+tests only verify that :func:`tavolo.app.cors_mixin_from_settings` maps the
+environment-driven :class:`~tavolo.config.Settings` onto it correctly. A
+minimal ``KayaApp`` is used instead of the global ``app`` so the tests do
+not depend on the environment the suite was imported with.
+"""
+from __future__ import annotations
+
+import os
+import unittest
+from unittest.mock import patch
+
+from httpx import ASGITransport, AsyncClient
+from kaya.core import HttpContext, KayaApp
+from pwo import async_test
+
+from tavolo.app import cors_mixin_from_settings
+from tavolo.config import Settings
+
+ORIGIN = "https://cards.example"
+
+
+def _settings(env: dict) -> Settings:
+    with patch.dict(os.environ, env, clear=True):
+        return Settings.from_env()
+
+
+def _app(settings: Settings) -> KayaApp:
+    mixin = cors_mixin_from_settings(settings)
+    assert mixin is not None
+    app = KayaApp(mixins=[mixin])
+
+    @app.GET("/api/health")
+    async def health(ctx: HttpContext) -> None:
+        await ctx.send_str(200, "ok")
+
+    return app
+
+
+class CorsMixinFromSettingsTests(unittest.TestCase):
+    def test_disabled_when_unconfigured(self):
+        self.assertIsNone(cors_mixin_from_settings(_settings({})))
+
+    def test_enabled_by_allow_origins(self):
+        self.assertIsNotNone(cors_mixin_from_settings(
+            _settings({"CORS_ALLOW_ORIGINS": ORIGIN})))
+
+    def test_enabled_by_allow_origin_regex_alone(self):
+        self.assertIsNotNone(cors_mixin_from_settings(
+            _settings({"CORS_ALLOW_ORIGIN_REGEX": r"https://.*\.example\.com"})))
+
+
+class CorsBehaviorTests(unittest.TestCase):
+    @async_test
+    async def test_request_without_origin_is_untouched(self) -> None:
+        app = _app(_settings({"CORS_ALLOW_ORIGINS": ORIGIN}))
+        async with AsyncClient(transport=ASGITransport(app=app),
+                               base_url="http://127.0.0.1") as client:
+            response = await client.get("/api/health")
+            self.assertEqual(200, response.status_code)
+            self.assertNotIn("access-control-allow-origin", response.headers)
+
+    @async_test
+    async def test_simple_request_with_allowed_origin(self) -> None:
+        app = _app(_settings({"CORS_ALLOW_ORIGINS": ORIGIN}))
+        async with AsyncClient(transport=ASGITransport(app=app),
+                               base_url="http://127.0.0.1") as client:
+            response = await client.get("/api/health", headers={"Origin": ORIGIN})
+            self.assertEqual(200, response.status_code)
+            self.assertEqual(ORIGIN, response.headers["access-control-allow-origin"])
+
+    @async_test
+    async def test_simple_request_with_disallowed_origin(self) -> None:
+        app = _app(_settings({"CORS_ALLOW_ORIGINS": ORIGIN}))
+        async with AsyncClient(transport=ASGITransport(app=app),
+                               base_url="http://127.0.0.1") as client:
+            response = await client.get(
+                "/api/health", headers={"Origin": "https://mallory.example"})
+            self.assertEqual(200, response.status_code)
+            self.assertNotIn("access-control-allow-origin", response.headers)
+
+    @async_test
+    async def test_preflight_allowed(self) -> None:
+        app = _app(_settings({
+            "CORS_ALLOW_ORIGINS": ORIGIN,
+            "CORS_ALLOW_METHODS": "GET,POST",
+            "CORS_MAX_AGE": "3600",
+        }))
+        async with AsyncClient(transport=ASGITransport(app=app),
+                               base_url="http://127.0.0.1") as client:
+            response = await client.options("/api/health", headers={
+                "Origin": ORIGIN,
+                "Access-Control-Request-Method": "POST",
+            })
+            self.assertEqual(200, response.status_code)
+            self.assertEqual(ORIGIN, response.headers["access-control-allow-origin"])
+            self.assertEqual("GET, POST", response.headers["access-control-allow-methods"])
+            self.assertEqual("3600", response.headers["access-control-max-age"])
+
+    @async_test
+    async def test_preflight_disallowed_origin(self) -> None:
+        app = _app(_settings({"CORS_ALLOW_ORIGINS": ORIGIN}))
+        async with AsyncClient(transport=ASGITransport(app=app),
+                               base_url="http://127.0.0.1") as client:
+            response = await client.options("/api/health", headers={
+                "Origin": "https://mallory.example",
+                "Access-Control-Request-Method": "GET",
+            })
+            self.assertEqual(400, response.status_code)
+            self.assertIn("Disallowed CORS", response.text)
+
+    @async_test
+    async def test_credentials_echo_origin_and_set_flag(self) -> None:
+        app = _app(_settings({
+            "CORS_ALLOW_ORIGINS": "*",
+            "CORS_ALLOW_CREDENTIALS": "true",
+        }))
+        async with AsyncClient(transport=ASGITransport(app=app),
+                               base_url="http://127.0.0.1") as client:
+            response = await client.get("/api/health", headers={"Origin": ORIGIN})
+            self.assertEqual(200, response.status_code)
+            self.assertEqual(ORIGIN, response.headers["access-control-allow-origin"])
+            self.assertEqual("true", response.headers["access-control-allow-credentials"])
+
+
+if __name__ == "__main__":
+    unittest.main()