feat(server): permissive CORS settings for preview service endpoints (s…

…pecklesystems#1273)
spgoad · Dec 15, 2022 · c19815f · c19815f
1 parent 170e52c
commit c19815f
Showing 1 changed file with 38 additions and 32 deletions.
diff --git a/packages/server/modules/previews/index.js b/packages/server/modules/previews/index.js
@@ -22,6 +22,8 @@ const { moduleLogger, logger } = require('@/logging/logging')
 const httpErrorImage = (httpErrorCode) =>
   require.resolve(`#/assets/previews/images/preview_${httpErrorCode}.png`)
 
+const cors = require('cors')
+
 const noPreviewImage = require.resolve('#/assets/previews/images/no_preview.png')
 const previewErrorImage = require.resolve('#/assets/previews/images/preview_error.png')
 
@@ -153,7 +155,7 @@ exports.init = (app) => {
     return { hasPermissions: true, httpErrorCode: 200 }
   }
 
-  app.get('/preview/:streamId/:angle?', async (req, res) => {
+  app.get('/preview/:streamId/:angle?', cors(), async (req, res) => {
     const { hasPermissions, httpErrorCode } = await checkStreamPermissions(req)
     if (!hasPermissions) {
       // return res.status( httpErrorCode ).end()
@@ -179,39 +181,43 @@ exports.init = (app) => {
     )
   })
 
-  app.get('/preview/:streamId/branches/:branchName/:angle?', async (req, res) => {
-    const { hasPermissions, httpErrorCode } = await checkStreamPermissions(req)
-    if (!hasPermissions) {
-      // return res.status( httpErrorCode ).end()
-      return res.sendFile(httpErrorImage(httpErrorCode))
-    }
+  app.get(
+    '/preview/:streamId/branches/:branchName/:angle?',
+    cors(),
+    async (req, res) => {
+      const { hasPermissions, httpErrorCode } = await checkStreamPermissions(req)
+      if (!hasPermissions) {
+        // return res.status( httpErrorCode ).end()
+        return res.sendFile(httpErrorImage(httpErrorCode))
+      }
 
-    let commitsObj
-    try {
-      commitsObj = await getCommitsByBranchName({
-        streamId: req.params.streamId,
-        branchName: req.params.branchName,
-        limit: 1
-      })
-    } catch {
-      commitsObj = {}
-    }
-    const { commits } = commitsObj
-    if (!commits || commits.length === 0) {
-      return res.sendFile(noPreviewImage)
+      let commitsObj
+      try {
+        commitsObj = await getCommitsByBranchName({
+          streamId: req.params.streamId,
+          branchName: req.params.branchName,
+          limit: 1
+        })
+      } catch {
+        commitsObj = {}
+      }
+      const { commits } = commitsObj
+      if (!commits || commits.length === 0) {
+        return res.sendFile(noPreviewImage)
+      }
+      const lastCommit = commits[0]
+
+      return sendObjectPreview(
+        req,
+        res,
+        req.params.streamId,
+        lastCommit.referencedObject,
+        req.params.angle || DEFAULT_ANGLE
+      )
     }
-    const lastCommit = commits[0]
-
-    return sendObjectPreview(
-      req,
-      res,
-      req.params.streamId,
-      lastCommit.referencedObject,
-      req.params.angle || DEFAULT_ANGLE
-    )
-  })
+  )
 
-  app.get('/preview/:streamId/commits/:commitId/:angle?', async (req, res) => {
+  app.get('/preview/:streamId/commits/:commitId/:angle?', cors(), async (req, res) => {
     const { hasPermissions, httpErrorCode } = await checkStreamPermissions(req)
     if (!hasPermissions) {
       // return res.status( httpErrorCode ).end()
@@ -233,7 +239,7 @@ exports.init = (app) => {
     )
   })
 
-  app.get('/preview/:streamId/objects/:objectId/:angle?', async (req, res) => {
+  app.get('/preview/:streamId/objects/:objectId/:angle?', cors(), async (req, res) => {
     const { hasPermissions } = await checkStreamPermissions(req)
     if (!hasPermissions) {
       // return res.status( httpErrorCode ).end()