From b5af0c5a5489ac329b305c1d165973978f6cb97d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Torsten=20L=C3=BCcke?= <privat@torsten-hettstedt.de>
Date: Mon, 12 Apr 2021 18:46:37 +0200
Subject: [PATCH] =?UTF-8?q?Vorbereitung=20f=C3=BCr=20Preflight-=20und=20CO?=
 =?UTF-8?q?RS-Abfragen.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 api/src/Controller/PreflightController.php    | 18 ++++++
 api/src/Middleware/ErrorHandler.php           |  4 +-
 .../Middleware/OriginAccessControlHandler.php | 60 +++++++++++++++++++
 3 files changed, 81 insertions(+), 1 deletion(-)
 create mode 100644 api/src/Controller/PreflightController.php
 create mode 100644 api/src/Middleware/OriginAccessControlHandler.php

diff --git a/api/src/Controller/PreflightController.php b/api/src/Controller/PreflightController.php
new file mode 100644
index 0000000..1ac6bf9
--- /dev/null
+++ b/api/src/Controller/PreflightController.php
@@ -0,0 +1,18 @@
+<?php
+
+
+namespace TorstenHettstedt\TimekeepingApi\Controller;
+
+
+use Psr\Http\Message\ResponseInterface;
+use Slim\Psr7\Request;
+use Slim\Psr7\Response;
+use TorstenHettstedt\TimekeepingApi\Middleware\OriginAccessControlHandler;
+
+class PreflightController
+{
+    public function preflight(Request $request, Response $response): ResponseInterface
+    {
+        return (new OriginAccessControlHandler())->originAccessControl($request, $response);
+    }
+}
\ No newline at end of file
diff --git a/api/src/Middleware/ErrorHandler.php b/api/src/Middleware/ErrorHandler.php
index 9693206..80d5f15 100644
--- a/api/src/Middleware/ErrorHandler.php
+++ b/api/src/Middleware/ErrorHandler.php
@@ -84,7 +84,9 @@ class ErrorHandler
             json_encode($payload, JSON_UNESCAPED_UNICODE)
         );
 
-        return $response;
+        $originAccessControlHandler = new OriginAccessControlHandler();
+
+        return $originAccessControlHandler->originAccessControl($request, $response);
     }
 
 }
\ No newline at end of file
diff --git a/api/src/Middleware/OriginAccessControlHandler.php b/api/src/Middleware/OriginAccessControlHandler.php
new file mode 100644
index 0000000..d29d7f0
--- /dev/null
+++ b/api/src/Middleware/OriginAccessControlHandler.php
@@ -0,0 +1,60 @@
+<?php
+
+
+namespace TorstenHettstedt\TimekeepingApi\Middleware;
+
+
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+use Psr\Http\Server\MiddlewareInterface;
+use Psr\Http\Server\RequestHandlerInterface as RequestHandler;
+use Slim\Routing\RouteContext;
+
+class OriginAccessControlHandler implements MiddlewareInterface
+{
+
+    /**
+     * Process an incoming server request.
+     *
+     * Processes an incoming server request in order to produce a response.
+     * If unable to produce the response itself, it may delegate to the provided
+     * request handler to do so.
+     */
+    public function process(Request $request, RequestHandler $handler): Response
+    {
+        $response = $handler->handle($request);
+
+
+        return $this->originAccessControl($request, $response);
+    }
+
+    public function originAccessControl(Request $request, Response $response): Response
+    {
+
+        $routeContext = RouteContext::fromRequest($request);
+        $routingResults = $routeContext->getRoutingResults();
+        $methods = $routingResults->getAllowedMethods();
+        $requestHeaders = $request->getHeaderLine('Access-Control-Request-Headers');
+
+        if ($this->testRoute($request)) {
+            $response = $response->withHeader('Access-Control-Allow-Origin', $this->buildOrigin($request));
+            $response = $response->withHeader('Access-Control-Allow-Methods', implode(',', $methods));
+            $response = $response->withHeader('Access-Control-Allow-Headers', $requestHeaders);
+
+            // Optional: Allow Ajax CORS requests with Authorization header
+            $response = $response->withHeader('Access-Control-Allow-Credentials', 'true');
+        }
+        return $response;
+    }
+
+    protected function testRoute(Request $request): bool
+    {
+        $corsAllowOriginRegex = $_ENV['CORS_ALLOW_ORIGIN_REGEX'] ?? '/https?:\/\/.*:.*/';
+        return preg_match($corsAllowOriginRegex, $this->buildOrigin($request));
+    }
+
+    protected function buildOrigin(Request $request): string
+    {
+        return $request->getHeaderLine('Origin') ?? '';
+    }
+}
\ No newline at end of file