Preflight- und CORS-Abfragen werden verarbeitet.

Vorbereitung für Preflight- und CORS-Abfragen.
Der Regex ist nun vollständig.
2021-04-12 18:47:48 +02:00 · 2021-04-12 18:46:37 +02:00 · 2021-04-12 18:45:16 +02:00 · 2021-04-12 18:26:57 +02:00 · 2021-04-12 18:26:12 +02:00 · 2021-04-12 15:56:35 +02:00
15 changed files with 217 additions and 34 deletions
@@ -2,4 +2,7 @@
 DATABASES_HOST=psql.domain.tld
 DATABASES_NAME=db
 DATABASES_USER=user
-DATABASES_PASS=1234
+DATABASES_PASS=1234
+
+## CORS Einstellungen
+CORS_ALLOW_ORIGIN_REGEX=/https?:\/\/localhost:\d+/
@@ -7,10 +7,12 @@ $dotenv->load();
 use DI\Container;
 use Slim\Factory\AppFactory;
 use Slim\Routing\RouteCollectorProxy;
+use TorstenHettstedt\TimekeepingApi\Controller\PreflightController;
 use TorstenHettstedt\TimekeepingApi\Controller\WorkingHoursController;
 use TorstenHettstedt\TimekeepingApi\Controller\WorkingHoursViewController;
 use TorstenHettstedt\TimekeepingApi\Middleware\ErrorHandler;
 use TorstenHettstedt\TimekeepingApi\Middleware\JsonBodyParserMiddleware;
+use TorstenHettstedt\TimekeepingApi\Middleware\OriginAccessControlHandler;

 $container = new Container();

@@ -22,17 +24,25 @@ $container->set('databases', function () {
 AppFactory::setContainer($container);
 $app = AppFactory::create();
 $app->add(new JsonBodyParserMiddleware());
+$app->addBodyParsingMiddleware();
+$app->add(new OriginAccessControlHandler());
+$app->addRoutingMiddleware();

 $app->group('/views/working-hours', function (RouteCollectorProxy $group) {
+    $group->options('/weekly', PreflightController::class . ':preflight');
    $group->get('/weekly', WorkingHoursViewController::class . ':browseWeekly');
+    $group->options('/monthly', PreflightController::class . ':preflight');
    $group->get('/monthly', WorkingHoursViewController::class . ':browseMonthly');
+    $group->options('/yearly', PreflightController::class . ':preflight');
    $group->get('/yearly', WorkingHoursViewController::class . ':browseYearly');
 });

 $app->group('/working-hours', function (RouteCollectorProxy $group) {
+    $group->options('', PreflightController::class . ':preflight');
    $group->get('', WorkingHoursController::class . ':browse');
    $group->post('', WorkingHoursController::class . ':creat');
    $group->group('/{id:\d\d\d\d-\d\d-\d\d}', function (RouteCollectorProxy $group) {
+        $group->options('', PreflightController::class . ':preflight');
        $group->get('', WorkingHoursController::class . ':read');
        $group->put('', WorkingHoursController::class . ':update');
    });
@@ -0,0 +1,18 @@
+<?php
+
+
+namespace TorstenHettstedt\TimekeepingApi\Controller;
+
+
+use Psr\Http\Message\ResponseInterface;
+use Slim\Psr7\Request;
+use Slim\Psr7\Response;
+use TorstenHettstedt\TimekeepingApi\Middleware\OriginAccessControlHandler;
+
+class PreflightController
+{
+    public function preflight(Request $request, Response $response): ResponseInterface
+    {
+        return (new OriginAccessControlHandler())->originAccessControl($request, $response);
+    }
+}
@@ -84,7 +84,9 @@ class ErrorHandler
            json_encode($payload, JSON_UNESCAPED_UNICODE)
        );

-        return $response;
+        $originAccessControlHandler = new OriginAccessControlHandler();
+
+        return $originAccessControlHandler->originAccessControl($request, $response);
    }

 }
@@ -0,0 +1,60 @@
+<?php
+
+
+namespace TorstenHettstedt\TimekeepingApi\Middleware;
+
+
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+use Psr\Http\Server\MiddlewareInterface;
+use Psr\Http\Server\RequestHandlerInterface as RequestHandler;
+use Slim\Routing\RouteContext;
+
+class OriginAccessControlHandler implements MiddlewareInterface
+{
+
+    /**
+     * Process an incoming server request.
+     *
+     * Processes an incoming server request in order to produce a response.
+     * If unable to produce the response itself, it may delegate to the provided
+     * request handler to do so.
+     */
+    public function process(Request $request, RequestHandler $handler): Response
+    {
+        $response = $handler->handle($request);
+
+
+        return $this->originAccessControl($request, $response);
+    }
+
+    public function originAccessControl(Request $request, Response $response): Response
+    {
+
+        $routeContext = RouteContext::fromRequest($request);
+        $routingResults = $routeContext->getRoutingResults();
+        $methods = $routingResults->getAllowedMethods();
+        $requestHeaders = $request->getHeaderLine('Access-Control-Request-Headers');
+
+        if ($this->testRoute($request)) {
+            $response = $response->withHeader('Access-Control-Allow-Origin', $this->buildOrigin($request));
+            $response = $response->withHeader('Access-Control-Allow-Methods', implode(',', $methods));
+            $response = $response->withHeader('Access-Control-Allow-Headers', $requestHeaders);
+
+            // Optional: Allow Ajax CORS requests with Authorization header
+            $response = $response->withHeader('Access-Control-Allow-Credentials', 'true');
+        }
+        return $response;
+    }
+
+    protected function testRoute(Request $request): bool
+    {
+        $corsAllowOriginRegex = $_ENV['CORS_ALLOW_ORIGIN_REGEX'] ?? '/https?:\/\/.*:.*/';
+        return preg_match($corsAllowOriginRegex, $this->buildOrigin($request));
+    }
+
+    protected function buildOrigin(Request $request): string
+    {
+        return $request->getHeaderLine('Origin') ?? '';
+    }
+}
@@ -32,4 +32,6 @@ class Api extends Module
        "message"   => "string",
        "path"      => "string",
    ];
+
+    const TEST_ORIGIN = 'http://localhost:1234';
 }
@@ -8,13 +8,23 @@ use Helper\Api;

 class BrowseWorkingHoursMonthlyCest
 {
+    public static function preflight(ApiTester $I): void
+    {
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
+        $I->haveHttpHeader('Access-Control-Request-Method', 'GET');
+        $I->sendOptions('/views/working-hours/monthly');
+        $I->seeResponseCodeIs(HttpCode::OK);
+    }
+
    /**
     * @param ApiTester $I
     */
    public function browseWorkingHoursView(ApiTester $I): void
    {
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
        $I->sendGet('/views/working-hours/monthly');
        $I->seeResponseCodeIs(HttpCode::OK);
+        $I->canSeeHttpHeader('Access-Control-Allow-Origin', Api::TEST_ORIGIN);
        $I->seeResponseIsJson();
        $I->seeResponseMatchesJsonType(Api::WORKING_HOURS_VIEW_JSON_FORMAT);
    }
@@ -8,13 +8,23 @@ use Helper\Api;

 class BrowseWorkingHoursWeeklyCest
 {
+    public static function preflight(ApiTester $I): void
+    {
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
+        $I->haveHttpHeader('Access-Control-Request-Method', 'GET');
+        $I->sendOptions('/views/working-hours/weekly');
+        $I->seeResponseCodeIs(HttpCode::OK);
+    }
+
    /**
     * @param ApiTester $I
     */
    public function browseWorkingHoursView(ApiTester $I): void
    {
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
        $I->sendGet('/views/working-hours/weekly');
        $I->seeResponseCodeIs(HttpCode::OK);
+        $I->canSeeHttpHeader('Access-Control-Allow-Origin', Api::TEST_ORIGIN);
        $I->seeResponseIsJson();
        $I->seeResponseMatchesJsonType(Api::WORKING_HOURS_VIEW_JSON_FORMAT);
    }
@@ -8,13 +8,23 @@ use Helper\Api;

 class BrowseWorkingHoursYearlyCest
 {
+    public static function preflight(ApiTester $I): void
+    {
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
+        $I->haveHttpHeader('Access-Control-Request-Method', 'GET');
+        $I->sendOptions('/views/working-hours/yearly');
+        $I->seeResponseCodeIs(HttpCode::OK);
+    }
+
    /**
     * @param ApiTester $I
     */
    public function browseWorkingHoursView(ApiTester $I): void
    {
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
        $I->sendGet('/views/working-hours/yearly');
        $I->seeResponseCodeIs(HttpCode::OK);
+        $I->canSeeHttpHeader('Access-Control-Allow-Origin', Api::TEST_ORIGIN);
        $I->seeResponseIsJson();
        $I->seeResponseMatchesJsonType(Api::WORKING_HOURS_VIEW_JSON_FORMAT);
    }
@@ -8,13 +8,23 @@ use Helper\Api;

 class BrowseWorkingHoursCest
 {
+    public static function preflight(ApiTester $I): void
+    {
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
+        $I->haveHttpHeader('Access-Control-Request-Method', 'GET');
+        $I->sendOptions('/working-hours');
+        $I->seeResponseCodeIs(HttpCode::OK);
+    }
+
    /**
     * @param ApiTester $I
     */
    public function browseWorkingHours(ApiTester $I): void
    {
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
        $I->sendGet('/working-hours');
        $I->seeResponseCodeIs(HttpCode::OK);
+        $I->canSeeHttpHeader('Access-Control-Allow-Origin', Api::TEST_ORIGIN);
        $I->seeResponseIsJson();
        $I->seeResponseMatchesJsonType(Api::WORKING_HOURS_JSON_FORMAT);
    }
@@ -8,15 +8,25 @@ use Helper\Api;

 class CreateWorkingHoursCest
 {
+    public static function preflight(ApiTester $I): void
+    {
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
+        $I->haveHttpHeader('Access-Control-Request-Method', 'POST');
+        $I->sendOptions('/working-hours');
+        $I->seeResponseCodeIs(HttpCode::OK);
+    }
+
    public function createWorkingHoursWithNewValidRecord(ApiTester $I): void
    {
        $I->haveHttpHeader('accept', 'application/json');
        $I->haveHttpHeader('content-type', 'application/json');
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
        $I->sendPost('/working-hours', [
            'workingDay'  => '2020-04-01',
            'workingTime' => '08:00:00',
        ]);
        $I->seeResponseCodeIs(HttpCode::CREATED);
+        $I->canSeeHttpHeader('Access-Control-Allow-Origin', Api::TEST_ORIGIN);
        $I->seeResponseIsJson();
        $I->seeResponseMatchesJsonType(Api::WORKING_HOURS_JSON_FORMAT);
    }
@@ -26,11 +36,13 @@ class CreateWorkingHoursCest
    {
        $I->haveHttpHeader('accept', 'application/json');
        $I->haveHttpHeader('content-type', 'application/json');
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
        $I->sendPost('/working-hours', [
            'workingDay'  => '2020-04-01',
            'workingTime' => 8.0,
        ]);
        $I->seeResponseCodeIs(HttpCode::BAD_REQUEST);
+        $I->canSeeHttpHeader('Access-Control-Allow-Origin', Api::TEST_ORIGIN);
        $I->seeResponseIsJson();
        $I->seeResponseMatchesJsonType(Api::ERROR_JSON_FORMAT);
    }
@@ -40,11 +52,13 @@ class CreateWorkingHoursCest
    {
        $I->haveHttpHeader('accept', 'application/json');
        $I->haveHttpHeader('content-type', 'application/json');
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
        $I->sendPost('/working-hours', [
            'workingDay'  => '2020-01-15',
            'workingTime' => '08:00:00',
        ]);
        $I->seeResponseCodeIs(HttpCode::CONFLICT);
+        $I->canSeeHttpHeader('Access-Control-Allow-Origin', Api::TEST_ORIGIN);
        $I->seeResponseIsJson();
        $I->seeResponseMatchesJsonType(Api::ERROR_JSON_FORMAT);
    }
@@ -8,18 +8,30 @@ use Helper\Api;

 class ReadWorkingHoursCest
 {
+    public static function preflight(ApiTester $I): void
+    {
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
+        $I->haveHttpHeader('Access-Control-Request-Method', 'GET');
+        $I->sendOptions('/working-hours/2020-04-15');
+        $I->seeResponseCodeIs(HttpCode::OK);
+    }
+
    public function readExistingWorkingHours(ApiTester $I): void
    {
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
        $I->sendGet('/working-hours/2020-01-15');
        $I->seeResponseCodeIs(HttpCode::OK);
+        $I->canSeeHttpHeader('Access-Control-Allow-Origin', Api::TEST_ORIGIN);
        $I->seeResponseIsJson();
        $I->seeResponseMatchesJsonType(Api::WORKING_HOURS_JSON_FORMAT);
    }

    public function readNotExistingWorkingHours(ApiTester $I): void
    {
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
        $I->sendGet('/working-hours/2020-04-15');
        $I->seeResponseCodeIs(HttpCode::NOT_FOUND);
+        $I->canSeeHttpHeader('Access-Control-Allow-Origin', Api::TEST_ORIGIN);
        $I->seeResponseIsJson();
        $I->seeResponseMatchesJsonType(Api::ERROR_JSON_FORMAT);
    }
@@ -8,15 +8,25 @@ use Helper\Api;

 class UpdateWorkingHoursCest
 {
+    public static function preflight(ApiTester $I): void
+    {
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
+        $I->haveHttpHeader('Access-Control-Request-Method', 'PUT');
+        $I->sendOptions('/working-hours/2020-01-15');
+        $I->seeResponseCodeIs(HttpCode::OK);
+    }
+
    public function updateWorkingHoursWithExistingValidRecord(ApiTester $I): void
    {
        $I->haveHttpHeader('accept', 'application/json');
        $I->haveHttpHeader('content-type', 'application/json');
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
        $I->sendPut('/working-hours/2020-01-15', [
            'workingDay'  => '2020-01-15',
            'workingTime' => '10:00:00',
        ]);
        $I->seeResponseCodeIs(HttpCode::OK);
+        $I->canSeeHttpHeader('Access-Control-Allow-Origin', Api::TEST_ORIGIN);
        $I->seeResponseIsJson();
        $I->seeResponseMatchesJsonType(Api::WORKING_HOURS_JSON_FORMAT);
    }
@@ -25,11 +35,13 @@ class UpdateWorkingHoursCest
    {
        $I->haveHttpHeader('accept', 'application/json');
        $I->haveHttpHeader('content-type', 'application/json');
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
        $I->sendPut('/working-hours/2020-04-15', [
            'workingDay'  => '2020-04-15',
            'workingTime' => '10:00:00',
        ]);
        $I->seeResponseCodeIs(HttpCode::NOT_FOUND);
+        $I->canSeeHttpHeader('Access-Control-Allow-Origin', Api::TEST_ORIGIN);
        $I->seeResponseIsJson();
        $I->seeResponseMatchesJsonType(Api::ERROR_JSON_FORMAT);
    }
@@ -38,11 +50,13 @@ class UpdateWorkingHoursCest
    {
        $I->haveHttpHeader('accept', 'application/json');
        $I->haveHttpHeader('content-type', 'application/json');
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
        $I->sendPut('/working-hours/2020-01-15', [
            'workingDay'  => '2020-01-15',
            'workingTime' => 8.0,
        ]);
        $I->seeResponseCodeIs(HttpCode::BAD_REQUEST);
+        $I->canSeeHttpHeader('Access-Control-Allow-Origin', Api::TEST_ORIGIN);
        $I->seeResponseIsJson();
        $I->seeResponseMatchesJsonType(Api::ERROR_JSON_FORMAT);
    }
@@ -45,22 +45,12 @@
 	addEventListener('pushstate', track);
 	addEventListener('popstate', track);

-
-    let r = {
-        "workingDay": "2020-01-15",
-        "workingTime": "09:00:00"
-    };
-    let records = {
-        "title" : "Einträge",
-        "records" : [r, r]
-    };
-
 	const router = Navaid('/')
 		.on('/', () => run(import('../routes/Home.svelte')))
 		.on('/views/weekly', () => run(import('../routes/WeeklyViews.svelte')))
 		.on('/views/monthly', () => run(import('../routes/MonthlyViews.svelte')))
 		.on('/views/yearly', () => run(import('../routes/YearlyViews.svelte')))
-		.on('/working-hours', () => run(import('../routes/WorkingHours.svelte'), records))
+		.on('/working-hours', () => run(import('../routes/WorkingHours.svelte')))
 		.listen();

 	onDestroy(router.unlisten);
@@ -24,7 +24,7 @@
                    return res.json();
                })
                .then(data => {
-                    activeRecord = null;
+                    Controller.cancelActiveRecord();
                    params.records = data;
                    params.isLoading = false;
                })
@@ -45,7 +45,7 @@
                .then(data => {
                    activeRecord = data;
                    if (date === null) {
-                        Records.browse();
+                        Controller.listRecords();
                    }
                })
                .catch(err => {
@@ -73,8 +73,7 @@
                    }
                })
                .then(() => {
-                    newRecord = false;
-                    Records.browse();
+                    Controller.listRecords();
                })
                .catch(err => {
                    console.log(err);
@@ -101,14 +100,39 @@
                    }
                })
                .then(() => {
-                    Records.browse();
+                    Controller.listRecords();
                })
                .catch(err => {
                    console.log(err);
                });
        }
    };
-    Records.browse();
+    const Controller = {
+        'listRecords': () => {
+            Controller.cancelActiveRecord();
+            Records.browse();
+        },
+        'newRecord': () => {
+            activeRecord = {workingTime: '00:00:00'};
+            newRecord = true;
+        },
+        'saveRecord': () => {
+            if (newRecord === true) {
+                Records.add(activeRecord);
+            } else {
+                Records.update(activeRecord.workingDay, activeRecord);
+            }
+        },
+        'selectActiveRecord': record => Records.read(record.workingDay),
+        'cancelActiveRecord': () => {
+            activeRecord = null;
+            newRecord = false;
+        }
+    };
+    const initSite = () => {
+        Controller.listRecords()
+    };
+    initSite()
 </script>

 <svelte:head>
@@ -127,7 +151,7 @@
                <!--suppress HtmlUnknownTarget -->
                <form action="/working-hours">
                    <fieldset>
-                        <button on:click={() => {activeRecord = {}; newRecord = true}}>Neuer Eintrag
+                        <button on:click={Controller.newRecord}>Neuer Eintrag
                            <IconifyIcon icon={documentIcon}/>
                        </button>
                    </fieldset>
@@ -146,7 +170,7 @@
                            <td>{record.workingDay}</td>
                            <td>{record.workingTime}</td>
                            <td>
-                                <button on:click={() => Records.read(record.workingDay)}>Bearbeiten
+                                <button on:click={() => Controller.selectActiveRecord(record)}>Bearbeiten
                                    <IconifyIcon icon={wrenchIcon}/>
                                </button>
                            </td>
@@ -168,26 +192,20 @@
                <fieldset name="record-data">
                    <div>
                        <label for="workingDay">Arbeitstag</label>
-                        <input bind:value={activeRecord.workingDay} placeholder="Arbeitstag" type="date"
-                               id="workingDay">
+                        <input bind:value={activeRecord.workingDay} type="date"
+                               id="workingDay" required pattern="\d{4}-\d{2}-\d{2}">
                    </div>
                    <div>
                        <label for="workingTime">Arbeitszeit</label>
                        <input bind:value={activeRecord.workingTime} placeholder="Arbeitszeit" type="time"
-                               id="workingTime">
+                               id="workingTime" required pattern="[0-5]\d:[0-5]\d:[0-5]\d">
                    </div>
                </fieldset>
                <fieldset name="buttons">
-                    {#if newRecord === true}
-                        <button on:click={() => Records.add(activeRecord)}>Übernehmen
-                            <IconifyIcon icon={checkIcon} color="green"/>
-                        </button>
-                    {:else}
-                        <button on:click={() => Records.update(activeRecord.workingDay, activeRecord)}>Übernehmen
-                            <IconifyIcon icon={checkIcon} color="green"/>
-                        </button>
-                    {/if}
-                    <button on:click={() => Records.read(null)}>Abbrechen
+                    <button on:click={Controller.saveRecord}>Übernehmen
+                        <IconifyIcon icon={checkIcon} color="green"/>
+                    </button>
+                    <button on:click={Controller.cancelActiveRecord}>Abbrechen
                        <IconifyIcon icon={xIcon}/>
                    </button>
                </fieldset>
Author	SHA1	Message	Date
Torstem_JetBrain	3fe73f3b10	Preflight- und CORS-Abfragen werden verarbeitet.	2021-04-12 18:47:48 +02:00
Torstem_JetBrain	b5af0c5a54	Vorbereitung für Preflight- und CORS-Abfragen.	2021-04-12 18:46:37 +02:00
Torstem_JetBrain	e29a6dcab9	Der Regex ist nun vollständig.	2021-04-12 18:45:16 +02:00
Torstem_JetBrain	8ee9666250	Die Tests wurden um die Preflight-Tests erweitert.	2021-04-12 18:26:57 +02:00
Torstem_JetBrain	edcb80421b	Der Browser sendet auch das Protokoll mit.	2021-04-12 18:26:12 +02:00
Torstem_JetBrain	16e05ce819	Die API-Tests wurden um eine Preflight-Überprüfung erweitert, um CORS-Probleme zu vermindern.	2021-04-12 15:56:35 +02:00
TorstenHettstedt	5c15580738	Merge pull request 'js-rest-aktionen' (#6 ) from js-rest-aktionen into master Reviewed-on: #6	2021-04-12 14:11:31 +02:00
Torstem_JetBrain	0a5e40d7cb	Es gibt ein Objekt 'Controller', dass die Funktionen für die Tasten-Aktionen sammelt. Es gibt nun eine Initialisierung-Funktion. Wenn eine Bearbeitung abgebrochen wird, wird nicht jedes mal die Liste neu geladen.	2021-04-12 14:11:00 +02:00
Torstem_JetBrain	ae7491f002	Die Eintragungen wurden wo möglich mit den Defaultwerten gesetzt. Ging aber nur bei der Angabe der Zeit.	2021-04-12 12:29:00 +02:00
Torstem_JetBrain	8296a2a281	Die Test-Objekte sind nicht mehr notwendig.	2021-04-10 15:42:21 +02:00