cet

%%%-------------------------------------------------------------------
%%% @author Juan Jose Comellas <juanjo@comellas.org>
%%% @copyright (C) 2015 Cielo24, Inc.
%%% @doc Cowboy middleware that adds the necessary headers to support
%%%      Cross-Origin Resource Sharing.
%%% @end
%%%-------------------------------------------------------------------
-module(cet_cors_middleware).
-author('Juan Jose Comellas <juanjo@comellas.org>').

-behaviour(cowboy_middleware).

-compile([{parse_transform, lager_transform}]).

-export([execute/2]).

-define(HDR_ACCESS_CONTROL_ALLOW_ORIGIN,             "access-control-allow-origin").
-define(HDR_ACCESS_CONTROL_ALLOW_HEADERS,            "access-control-allow-headers").
-define(HDR_ACCESS_CONTROL_ALLOW_METHODS,            "access-control-allow-methods").
-define(HDR_ACCESS_CONTROL_MAX_AGE,                  "access-control-max-age").
-define(HDR_ACCESS_CONTROL_ALLOW_CREDENTIALS,        "access-control-allow-credentials").
-define(HDR_ACCESS_CONTROL_EXPOSE_HEADERS,           "access-control-expose-headers").
-define(HDR_ORIGIN,                                  "origin").


execute(Req0, Env) ->
    Req = maybe_add_cors_headers(Req0),
    {ok, Req, Env}.


-spec maybe_add_cors_headers(cowboy_req:req()) -> cowboy_req:req().
maybe_add_cors_headers(Req0) ->
    case cowboy_req:header(<<?HDR_ORIGIN>>, Req0) of
        {undefined, Req} ->
            Req;
        {Origin, Req} ->
            Domains = mdps:get_env(cors_domains, []),
            case lists:member(Origin, Domains) of
                true ->
                    lager:debug("CORS is allowed for domains ~s~n", [Origin]),
                    add_cors_headers(Req, Origin);
                false ->
                    lager:info("CORS is not allowed for domains ~s", [Origin]),
                    Req
            end
    end.

add_cors_headers(Req0, Origin) ->
    Headers =
        [{<<?HDR_ACCESS_CONTROL_ALLOW_ORIGIN>>,      Origin},
         {<<?HDR_ACCESS_CONTROL_ALLOW_HEADERS>>,     <<"origin, x-requested-with, content-type, accept, accept-language, accept-encoding">>},
         {<<?HDR_ACCESS_CONTROL_ALLOW_METHODS>>,     <<"GET">>},
         {<<?HDR_ACCESS_CONTROL_MAX_AGE>>,           integer_to_binary(mdps:get_env(cors_lifetime))},
         {<<?HDR_ACCESS_CONTROL_ALLOW_CREDENTIALS>>, <<"true">>},
         {<<?HDR_ACCESS_CONTROL_EXPOSE_HEADERS>>,    <<"location">>}],
    lists:foldl(fun ({Header, Value}, Req) ->
                        cowboy_req:set_resp_header(Header, Value, Req)
                end, Req0, Headers).