platform/lib/angel_cors.dart

/// Angel CORS middleware.
library angel_cors;

import 'package:angel_framework/angel_framework.dart';
import 'src/cors_options.dart';
export 'src/cors_options.dart';

/// Determines if a request origin is CORS-able.
typedef bool CorsFilter(String origin);

bool _isOriginAllowed(String origin, allowedOrigin) {
  allowedOrigin ??= [];
  if (allowedOrigin is List) {
    return allowedOrigin.any((x) => _isOriginAllowed(origin, x));
  } else if (allowedOrigin is String) {
    return origin == allowedOrigin;
  } else if (allowedOrigin is RegExp) {
    return origin != null && allowedOrigin.hasMatch(origin);
  } else if (origin != null && allowedOrigin is CorsFilter) {
    return allowedOrigin(origin);
  } else {
    return allowedOrigin != false;
  }
}

/// Applies the given [CorsOptions].
RequestMiddleware cors([CorsOptions options]) {
  final opts = options ?? new CorsOptions();

  return (RequestContext req, ResponseContext res) async {
    // Access-Control-Allow-Credentials
    if (opts.credentials == true) {
      res.headers['Access-Control-Allow-Credentials'] = 'true';
    }

    // Access-Control-Allow-Headers
    if (req.method == 'OPTIONS' && opts.allowedHeaders.isNotEmpty) {
      res.headers['Access-Control-Allow-Headers'] =
          opts.allowedHeaders.join(',');
    } else if (req.headers['Access-Control-Request-Headers'] != null) {
      res.headers['Access-Control-Allow-Headers'] =
          req.headers.value('Access-Control-Request-Headers');
    }

    // Access-Control-Expose-Headers
    if (opts.exposedHeaders.isNotEmpty) {
      res.headers['Access-Control-Expose-Headers'] =
          opts.exposedHeaders.join(',');
    }

    // Access-Control-Allow-Methods
    if (req.method == 'OPTIONS' && opts.methods.isNotEmpty) {
      res.headers['Access-Control-Allow-Methods'] = opts.methods.join(',');
    }

    // Access-Control-Max-Age
    if (req.method == 'OPTIONS' && opts.maxAge != null) {
      res.headers['Access-Control-Max-Age'] = opts.maxAge.toString();
    }

    // Access-Control-Allow-Origin
    if (opts.origin == false || opts.origin == '*') {
      res.headers['Access-Control-Allow-Origin'] = '*';
    } else if (opts.origin is String) {
      res
        ..headers['Access-Control-Allow-Origin'] = opts.origin
        ..headers['Vary'] = 'Origin';
    } else {
      bool isAllowed =
          _isOriginAllowed(req.headers.value('Origin'), opts.origin);

      res.headers['Access-Control-Allow-Origin'] =
          isAllowed ? req.headers.value('Origin') : false.toString();

      if (isAllowed) {
        res.headers['Vary'] = 'Origin';
      }
    }

    return req.method != 'OPTIONS' || opts.preflightContinue;
  };
}