Implement CORS Fairing (#9)

* Add validate to Cors

* Skeleton

* Refactor to allow for fairings to be even built

* Errors are not handled properly

* Response no longer validates

* Ad-hoc response now use response guards

* Seems like lifetime proliferation

* Wrap Response in a Guard with some dummy lifetime

* Fairing implementation

tests/ad_hoc.rs

@@ -1,37 +1,68 @@
-//! This crate tests using rocket_cors using the "classic" per-route handling
+//! This crate tests using rocket_cors using the "classic" ad-hoc per-route handling
 
 #![feature(plugin, custom_derive)]
 #![plugin(rocket_codegen)]
 extern crate hyper;
 extern crate rocket;
-extern crate rocket_cors;
+extern crate rocket_cors as cors;
 
 use std::str::FromStr;
 
-use rocket::State;
+use rocket::{Response, State};
 use rocket::http::Method;
 use rocket::http::{Header, Status};
 use rocket::local::Client;
-use rocket_cors::*;
 
 #[options("/")]
-fn cors_options(options: State<rocket_cors::Cors>) -> Responder<&str> {
+fn cors_options(cors: cors::Guard) -> cors::Responder<&str> {
-    rocket_cors::respond(options, "")
+    cors.responder("")
 }
 
 #[get("/")]
-fn cors(options: State<rocket_cors::Cors>) -> Responder<&str> {
+fn cors(cors: cors::Guard) -> cors::Responder<&str> {
-    rocket_cors::respond(options, "Hello CORS")
+    cors.responder("Hello CORS")
 }
 
-fn make_cors_options() -> Cors {
+// The following routes tests that the routes can be compiled with ad-hoc CORS Response/Responders
-    let (allowed_origins, failed_origins) = AllOrSome::new_from_str_list(&["https://www.acme.com"]);
+
+/// Using a `Response` instead of a `Responder`
+#[allow(unmounted_route)]
+#[get("/")]
+fn response(cors: cors::Guard) -> Response {
+    cors.response(Response::new())
+}
+
+/// `Responder` with String
+#[allow(unmounted_route)]
+#[get("/")]
+fn responder_string(cors: cors::Guard) -> cors::Responder<String> {
+    cors.responder("Hello CORS".to_string())
+}
+
+/// `Responder` with 'static ()
+#[allow(unmounted_route)]
+#[get("/")]
+fn responder_unit(cors: cors::Guard) -> cors::Responder<()> {
+    cors.responder(())
+}
+
+struct SomeState;
+/// Borrow `SomeState` from Rocket
+#[allow(unmounted_route)]
+#[get("/")]
+fn state<'r>(cors: cors::Guard<'r>, _state: State<'r, SomeState>) -> cors::Responder<'r, &'r str> {
+    cors.responder("hmm")
+}
+
+fn make_cors_options() -> cors::Cors {
+    let (allowed_origins, failed_origins) =
+        cors::AllOrSome::new_from_str_list(&["https://www.acme.com"]);
     assert!(failed_origins.is_empty());
 
-    Cors {
+    cors::Cors {
         allowed_origins: allowed_origins,
         allowed_methods: [Method::Get].iter().cloned().collect(),
-        allowed_headers: AllOrSome::Some(
+        allowed_headers: cors::AllOrSome::Some(
             ["Authorization"]
                 .into_iter()
                 .map(|s| s.to_string().into())
@@ -44,12 +75,13 @@ fn make_cors_options() -> Cors {
 
 #[test]
 fn smoke_test() {
-    let (allowed_origins, failed_origins) = AllOrSome::new_from_str_list(&["https://www.acme.com"]);
+    let (allowed_origins, failed_origins) =
+        cors::AllOrSome::new_from_str_list(&["https://www.acme.com"]);
     assert!(failed_origins.is_empty());
-    let cors_options = rocket_cors::Cors {
+    let cors_options = cors::Cors {
         allowed_origins: allowed_origins,
         allowed_methods: [Method::Get].iter().cloned().collect(),
-        allowed_headers: AllOrSome::Some(
+        allowed_headers: cors::AllOrSome::Some(
             ["Authorization"]
                 .iter()
                 .map(|s| s.to_string().into())
@@ -81,7 +113,7 @@ fn smoke_test() {
         .header(request_headers);
 
     let response = req.dispatch();
-    assert_eq!(response.status(), Status::Ok);
+    assert!(response.status().class().is_success());
 
     // "Actual" request
     let origin_header = Header::from(
@@ -91,7 +123,7 @@ fn smoke_test() {
     let req = client.get("/").header(origin_header).header(authorization);
 
     let mut response = req.dispatch();
-    assert_eq!(response.status(), Status::Ok);
+    assert!(response.status().class().is_success());
     let body_str = response.body().and_then(|body| body.into_string());
     assert_eq!(body_str, Some("Hello CORS".to_string()));
 
@@ -121,7 +153,7 @@ fn cors_options_check() {
         .header(request_headers);
 
     let response = req.dispatch();
-    assert_eq!(response.status(), Status::Ok);
+    assert!(response.status().class().is_success());
 }
 
 #[test]
@@ -139,7 +171,7 @@ fn cors_get_check() {
 
     let mut response = req.dispatch();
     println!("{:?}", response);
-    assert_eq!(response.status(), Status::Ok);
+    assert!(response.status().class().is_success());
     let body_str = response.body().and_then(|body| body.into_string());
     assert_eq!(body_str, Some("Hello CORS".to_string()));
 }
@@ -156,7 +188,7 @@ fn cors_get_no_origin() {
     let req = client.get("/").header(authorization);
 
     let mut response = req.dispatch();
-    assert_eq!(response.status(), Status::Ok);
+    assert!(response.status().class().is_success());
     let body_str = response.body().and_then(|body| body.into_string());
     assert_eq!(body_str, Some("Hello CORS".to_string()));
 }
@@ -207,7 +239,7 @@ fn cors_options_missing_origin() {
     );
 
     let response = req.dispatch();
-    assert_eq!(response.status(), Status::Ok);
+    assert!(response.status().class().is_success());
 }
 
 #[test]

tests/fairings.rs

@@ -0,0 +1,240 @@
+//! This crate tests using rocket_cors using Fairings
+
+#![feature(plugin, custom_derive)]
+#![plugin(rocket_codegen)]
+extern crate hyper;
+extern crate rocket;
+extern crate rocket_cors;
+
+use std::str::FromStr;
+
+use rocket::http::Method;
+use rocket::http::{Header, Status};
+use rocket::local::Client;
+use rocket_cors::*;
+
+#[get("/")]
+fn cors<'a>() -> &'a str {
+    "Hello CORS"
+}
+
+fn make_cors_options() -> Cors {
+    let (allowed_origins, failed_origins) = AllOrSome::new_from_str_list(&["https://www.acme.com"]);
+    assert!(failed_origins.is_empty());
+
+    Cors {
+        allowed_origins: allowed_origins,
+        allowed_methods: [Method::Get].iter().cloned().collect(),
+        allowed_headers: AllOrSome::Some(
+            ["Authorization"]
+                .into_iter()
+                .map(|s| s.to_string().into())
+                .collect(),
+        ),
+        allow_credentials: true,
+        ..Default::default()
+    }
+}
+
+fn rocket() -> rocket::Rocket {
+    rocket::ignite().mount("/", routes![cors]).attach(
+        make_cors_options(),
+    )
+}
+
+#[test]
+fn smoke_test() {
+    let client = Client::new(rocket()).unwrap();
+
+    // `Options` pre-flight checks
+    let origin_header = Header::from(
+        hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
+    );
+    let method_header = Header::from(hyper::header::AccessControlRequestMethod(
+        hyper::method::Method::Get,
+    ));
+    let request_headers = hyper::header::AccessControlRequestHeaders(
+        vec![FromStr::from_str("Authorization").unwrap()],
+    );
+    let request_headers = Header::from(request_headers);
+    let req = client
+        .options("/")
+        .header(origin_header)
+        .header(method_header)
+        .header(request_headers);
+
+    let response = req.dispatch();
+    assert!(response.status().class().is_success());
+
+    // "Actual" request
+    let origin_header = Header::from(
+        hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
+    );
+    let authorization = Header::new("Authorization", "let me in");
+    let req = client.get("/").header(origin_header).header(authorization);
+
+    let mut response = req.dispatch();
+    assert!(response.status().class().is_success());
+    let body_str = response.body().and_then(|body| body.into_string());
+    assert_eq!(body_str, Some("Hello CORS".to_string()));
+
+}
+
+#[test]
+fn cors_options_check() {
+    let client = Client::new(rocket()).unwrap();
+
+    let origin_header = Header::from(
+        hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
+    );
+    let method_header = Header::from(hyper::header::AccessControlRequestMethod(
+        hyper::method::Method::Get,
+    ));
+    let request_headers = hyper::header::AccessControlRequestHeaders(
+        vec![FromStr::from_str("Authorization").unwrap()],
+    );
+    let request_headers = Header::from(request_headers);
+    let req = client
+        .options("/")
+        .header(origin_header)
+        .header(method_header)
+        .header(request_headers);
+
+    let response = req.dispatch();
+    assert!(response.status().class().is_success());
+}
+
+#[test]
+fn cors_get_check() {
+    let client = Client::new(rocket()).unwrap();
+
+    let origin_header = Header::from(
+        hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
+    );
+    let authorization = Header::new("Authorization", "let me in");
+    let req = client.get("/").header(origin_header).header(authorization);
+
+    let mut response = req.dispatch();
+    println!("{:?}", response);
+    assert!(response.status().class().is_success());
+    let body_str = response.body().and_then(|body| body.into_string());
+    assert_eq!(body_str, Some("Hello CORS".to_string()));
+}
+
+/// This test is to check that non CORS compliant requests to GET should still work. (i.e. curl)
+#[test]
+fn cors_get_no_origin() {
+    let client = Client::new(rocket()).unwrap();
+
+    let authorization = Header::new("Authorization", "let me in");
+    let req = client.get("/").header(authorization);
+
+    let mut response = req.dispatch();
+    assert!(response.status().class().is_success());
+    let body_str = response.body().and_then(|body| body.into_string());
+    assert_eq!(body_str, Some("Hello CORS".to_string()));
+}
+
+#[test]
+fn cors_options_bad_origin() {
+    let client = Client::new(rocket()).unwrap();
+
+    let origin_header = Header::from(
+        hyper::header::Origin::from_str("https://www.bad-origin.com").unwrap(),
+    );
+    let method_header = Header::from(hyper::header::AccessControlRequestMethod(
+        hyper::method::Method::Get,
+    ));
+    let request_headers = hyper::header::AccessControlRequestHeaders(
+        vec![FromStr::from_str("Authorization").unwrap()],
+    );
+    let request_headers = Header::from(request_headers);
+    let req = client
+        .options("/")
+        .header(origin_header)
+        .header(method_header)
+        .header(request_headers);
+
+    let response = req.dispatch();
+    assert_eq!(response.status(), Status::Forbidden);
+}
+
+#[test]
+fn cors_options_missing_origin() {
+    let client = Client::new(rocket()).unwrap();
+
+    let method_header = Header::from(hyper::header::AccessControlRequestMethod(
+        hyper::method::Method::Get,
+    ));
+    let request_headers = hyper::header::AccessControlRequestHeaders(
+        vec![FromStr::from_str("Authorization").unwrap()],
+    );
+    let request_headers = Header::from(request_headers);
+    let req = client.options("/").header(method_header).header(
+        request_headers,
+    );
+
+    let response = req.dispatch();
+    assert!(response.status().class().is_success());
+}
+
+#[test]
+fn cors_options_bad_request_method() {
+    let client = Client::new(rocket()).unwrap();
+
+    let origin_header = Header::from(
+        hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
+    );
+    let method_header = Header::from(hyper::header::AccessControlRequestMethod(
+        hyper::method::Method::Post,
+    ));
+    let request_headers = hyper::header::AccessControlRequestHeaders(
+        vec![FromStr::from_str("Authorization").unwrap()],
+    );
+    let request_headers = Header::from(request_headers);
+    let req = client
+        .options("/")
+        .header(origin_header)
+        .header(method_header)
+        .header(request_headers);
+
+    let response = req.dispatch();
+    assert_eq!(response.status(), Status::Forbidden);
+}
+
+#[test]
+fn cors_options_bad_request_header() {
+    let client = Client::new(rocket()).unwrap();
+
+    let origin_header = Header::from(
+        hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
+    );
+    let method_header = Header::from(hyper::header::AccessControlRequestMethod(
+        hyper::method::Method::Get,
+    ));
+    let request_headers =
+        hyper::header::AccessControlRequestHeaders(vec![FromStr::from_str("Foobar").unwrap()]);
+    let request_headers = Header::from(request_headers);
+    let req = client
+        .options("/")
+        .header(origin_header)
+        .header(method_header)
+        .header(request_headers);
+
+    let response = req.dispatch();
+    assert_eq!(response.status(), Status::Forbidden);
+}
+
+#[test]
+fn cors_get_bad_origin() {
+    let client = Client::new(rocket()).unwrap();
+
+    let origin_header = Header::from(
+        hyper::header::Origin::from_str("https://www.bad-origin.com").unwrap(),
+    );
+    let authorization = Header::new("Authorization", "let me in");
+    let req = client.get("/").header(origin_header).header(authorization);
+
+    let response = req.dispatch();
+    assert_eq!(response.status(), Status::Forbidden);
+}

tests/headers.rs

@@ -9,7 +9,7 @@ use std::ops::Deref;
 use std::str::FromStr;
 
 use rocket::local::Client;
-use rocket::http::{Header, Status};
+use rocket::http::Header;
 use rocket_cors::headers::*;
 
 #[get("/request_headers")]
@@ -52,7 +52,7 @@ fn request_headers_round_trip_smoke_test() {
         .header(request_headers);
     let mut response = req.dispatch();
 
-    assert_eq!(Status::Ok, response.status());
+    assert!(response.status().class().is_success());
     let body_str = response.body().and_then(|body| body.into_string()).expect(
         "Non-empty body",
     );