udata 9.1.2.dev30382__py2.py3-none-any.whl → 9.1.2.dev30472__py2.py3-none-any.whl

udata/api/__init__.py

@@ -15,11 +15,10 @@ from flask import (
     request,
     url_for,
 )
-from flask_cors import CORS
 from flask_restx import Api, Resource
 from flask_storage import UnauthorizedFileType
 
-from udata import entrypoints, tracking
+from udata import cors, entrypoints, tracking
 from udata.app import csrf
 from udata.auth import Permission, PermissionDenied, RoleNeed, current_user, login_user
 from udata.i18n import get_locale
@@ -37,38 +36,6 @@ apiv2_blueprint = Blueprint("apiv2", __name__, url_prefix="/api/2")
 DEFAULT_PAGE_SIZE = 50
 HEADER_API_KEY = "X-API-KEY"
 
-# TODO: make upstream flask-restplus automatically handle
-# flask-restplus headers and allow lazy evaluation
-# of headers (ie. callable)
-PREFLIGHT_HEADERS = (
-    HEADER_API_KEY,
-    "X-Fields",
-    "Content-Type",
-    "Accept",
-    "Accept-Charset",
-    "Accept-Language",
-    "Authorization",
-    "Cache-Control",
-    "Content-Encoding",
-    "Content-Length",
-    "Content-Security-Policy",
-    "Content-Type",
-    "Cookie",
-    "ETag",
-    "Host",
-    "If-Modified-Since",
-    "Keep-Alive",
-    "Last-Modified",
-    "Origin",
-    "Referer",
-    "User-Agent",
-    "X-Forwarded-For",
-    "X-Forwarded-Port",
-    "X-Forwarded-Proto",
-)
-
-cors = CORS(allow_headers=PREFLIGHT_HEADERS)
-
 
 class UDataApi(Api):
     def __init__(self, app=None, **kwargs):
@@ -367,4 +334,3 @@ def init_app(app):
     from udata.api.oauth2 import init_app as oauth2_init_app
 
     oauth2_init_app(app)
-    cors.init_app(app)

udata/app.py

@@ -13,7 +13,7 @@ from flask_wtf.csrf import CSRFProtect
 from speaklater import is_lazy_string
 from werkzeug.middleware.proxy_fix import ProxyFix
 
-from udata import entrypoints
+from udata import cors, entrypoints
 
 APP_NAME = __name__.split(".")[0]
 ROOT_DIR = abspath(join(dirname(__file__)))
@@ -214,6 +214,7 @@ def register_extensions(app):
         tasks,
     )
 
+    cors.init_app(app)
     tasks.init_app(app)
     i18n.init_app(app)
     mongo.init_app(app)

udata/core/reports/api.py

@@ -21,13 +21,13 @@ class ReportsAPI(API):
 
         return Report.apply_sort_filters_and_pagination(query)
 
-    @api.secure
     @api.doc("create_report", responses={400: "Validation error"})
     @api.expect(Report.__write_fields__)
     @api.marshal_with(Report.__read_fields__, code=201)
     def post(self):
         report = patch(Report(), request)
-        report.by = current_user._get_current_object()
+        if current_user.is_authenticated:
+            report.by = current_user._get_current_object()
 
         try:
             report.save()

udata/cors.py

@@ -0,0 +1,99 @@
+import logging
+
+from flask import request
+from werkzeug.datastructures import Headers
+
+log = logging.getLogger(__name__)
+
+
+def add_vary(headers: Headers, header: str):
+    values = headers.getlist("Vary")
+    if header not in values:
+        values.append(header)
+    headers.set("Vary", ", ".join(values))
+
+
+def add_actual_request_headers(headers: Headers) -> Headers:
+    origin = request.headers.get("Origin", None)
+    if origin:
+        headers.set("Access-Control-Allow-Origin", origin)
+        add_vary(headers, "Origin")
+
+        headers.set("Access-Control-Allow-Credentials", "true")
+
+    return headers
+
+
+def is_preflight_request() -> bool:
+    return (
+        request.method == "OPTIONS"
+        and request.headers.get("Access-Control-Request-Method", None) is not None
+    )
+
+
+def is_allowed_cors_route():
+    return (
+        request.path.endswith((".js", ".css", ".woff", ".woff2", ".png", ".jpg", ".jpeg", ".svg"))
+        or request.path.startswith("/api")
+        or request.path.startswith("/oauth")
+    )
+
+
+def add_preflight_request_headers(headers: Headers) -> Headers:
+    origin = request.headers.get("Origin", None)
+    if origin:
+        headers.set("Access-Control-Allow-Origin", origin)
+        add_vary(headers, "Origin")
+
+        headers.set("Access-Control-Allow-Credentials", "true")
+
+        # The API allows all methods, so just copy the browser requested methods from the request headers.
+        headers.set(
+            "Access-Control-Allow-Methods", request.headers.get("Access-Control-Request-Method", "")
+        )
+        add_vary(headers, "Access-Control-Request-Method")
+
+        headers.set(
+            "Access-Control-Allow-Headers",
+            request.headers.get("Access-Control-Request-Headers", ""),
+        )
+        add_vary(headers, "Access-Control-Request-Headers")
+
+    return headers
+
+
+def init_app(app):
+    """
+    The CORS should be enabled before routing to trigger before some redirects.
+
+        For OPTIONS requests, we do not call the backend API code at all.
+    We just return the access-control headers.
+
+    For other requests, we append the access-control headers to the original
+    response.
+
+    This module is inspired by:
+    - the CORS logic https://github.com/fruitcake/php-cors/blob/master/src/CorsService.php
+    - the middleware https://github.com/laravel/framework/blob/11.x/src/Illuminate/Http/Middleware/HandleCors.php
+    """
+
+    @app.before_request
+    def bypass_code_for_options_requests():
+        if not is_allowed_cors_route():
+            return
+
+        if is_preflight_request():
+            headers = add_preflight_request_headers(Headers())
+            return "", 204, headers
+
+    @app.after_request
+    def add_cors_headers(response):
+        if not is_allowed_cors_route():
+            return response
+
+        if request.method == "OPTIONS":
+            add_vary(response.headers, "Access-Control-Request-Method")
+
+        add_actual_request_headers(response.headers)
+
+        return response

udata/routing.py

@@ -212,7 +212,7 @@ def lazy_raise_or_redirect():
             new_args = request.view_args
             new_args[name] = value.arg
             new_url = url_for(request.endpoint, **new_args)
-            return redirect(new_url, code=204 if request.method == "OPTIONS" else 308)
+            return redirect(new_url, 308)
 
 
 def init_app(app):