feat: Add CORS capability to HTTP API

[fredcarle]

RELEVANT ISSUE(S)

Resolves #408

DESCRIPTION

This PR adds CORS capability to the HTTP API. In situations where the database will be accessed from a different domain than that of the Defra host, the HTTP API needs to communicate to the browser the allowed origins and handle preflight requests.

HOW HAS THIS BEEN TESTED?

Unit tests and curl with allowedOrigins set to http://test.com

# this will result in an unsuccessful Preflight request
curl -i http://localhost:9181/api/v1/ping -H "Origin: http://no.com" -H "Access-Control-Request-Method: GET" -X OPTIONS

# this will result in an successful Preflight request
curl -i http://localhost:9181/api/v1/ping -H "Origin: http://test.com" -H "Access-Control-Request-Method: GET" -X OPTIONS

CHECKLIST:

• I have commented the code, particularly in hard-to-understand areas.
• I have made corresponding changes to the repo-held documentation.
• I have made sure that the PR title adheres to the conventional commit style (subset of the ones we use can be found under: tools/configs/chglog/config.yml

ENVIRONMENT / OS THIS WAS TESTED ON?

Please specify which of the following was this tested on (remove or add your own):

• Arch Linux
• Debian Linux
• MacOS
• Windows

[AndrewSisley]

Approved with a couple of non-blocking comments (mostly on your comments/questions) :)

[AndrewSisley]

Re-approving via comment after the latest changes. Looks good :)

[orpheuslummis]

After #389 merges (if that is the case), I suggest that the CORS configuration should then be part of top-level config package.

[jsimnz]

After #389 merges (if that is the case), I suggest that the CORS configuration should then be part of top-level config package.

Yupp, was going to mention this. We should find a way to track PRs that need to make changes to the config stuff (once its merged)

[shahzadlone]

Did you get a chance to test this with Apolo Studio? I tried (maybe I am doing something wrong) and it gives me a 404, or asks me Are CORS headers present?.

[fredcarle]

Did you get a chance to test this with Apolo Studio? I tried (maybe I am doing something wrong) and it gives me a 404, or asks me Are CORS headers present?.

Could you give me the details of your request please? (Method, URL, Body, Headers). Apollo is giving me some problems with local requests so I'll have to try something different to test it out.

[shahzadlone]

Could you give me the details of your request please? (Method, URL, Body, Headers). Apollo is giving me some problems with local requests so I'll have to try something different to test it out.

So, I just go to https://www.apollographql.com and login and try to get it set up with defradb. Idk what Method, URL, Body and Headers it's request contains.

[fredcarle]

So, I just go to https://www.apollographql.com and login and try to get it set up with defradb. Idk what Method, URL, Body and Headers it's request contains.

I made it work. Because the config PR hasn't been merged, there is still no way to set the allowedOrigins from the cli. You have to set it up manually in the code. Go to cli/defradb/cmd/start.go at line 184 and http.WithAllowedOrigins:

s := http.NewServer(db, http.WithAddress(config.Database.Address), http.WithAllowedOrigins("https://studio.apollographql.com"))

[shahzadlone]

So, I just go to https://www.apollographql.com and login and try to get it set up with defradb. Idk what Method, URL, Body and Headers it's request contains.

I made it work. Because the config PR hasn't been merged, there is still no way to set the allowedOrigins from the cli. You have to set it up manually in the code. Go to cli/defradb/cmd/start.go at line 184 and http.WithAllowedOrigins:

s := http.NewServer(db, http.WithAddress(config.Database.Address), http.WithAllowedOrigins("https://studio.apollographql.com"))

Awesome. Cheers!

[codecov]

Codecov Report

Merging #467 (31a5179) into develop (707c124) will increase coverage by 0.09%.
The diff coverage is 100.00%.

@@             Coverage Diff             @@
##           develop     #467      +/-   ##
===========================================
+ Coverage    52.46%   52.55%   +0.09%     
===========================================
  Files           97       97              
  Lines        13144    13170      +26     
===========================================
+ Hits          6896     6922      +26     
  Misses        5574     5574              
  Partials       674      674              

Impacted Files	Coverage Δ
api/http/handler.go	100.00% <100.00%> (ø)
api/http/router.go	100.00% <100.00%> (ø)
api/http/server.go	100.00% <100.00%> (ø)