From 423a1bdf2e89b73ac2aca10e1a20891d5fc01715 Mon Sep 17 00:00:00 2001
From: Hassan Abouelela <47495861+HassanAbouelela@users.noreply.github.com>
Date: Fri, 19 Feb 2021 10:12:46 +0300
Subject: Adds CORS Rules

Signed-off-by: Hassan Abouelela <47495861+HassanAbouelela@users.noreply.github.com>
---
 backend/__init__.py | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

(limited to 'backend/__init__.py')

diff --git a/backend/__init__.py b/backend/__init__.py
index a3704a0..d56edfb 100644
--- a/backend/__init__.py
+++ b/backend/__init__.py
@@ -7,10 +7,20 @@ from starlette.middleware.cors import CORSMiddleware
 
 from backend import constants
 from backend.authentication import JWTAuthenticationBackend
-from backend.route_manager import create_route_map
 from backend.middleware import DatabaseMiddleware, ProtectedDocsMiddleware
+from backend.route_manager import create_route_map
 from backend.validation import api
 
+ORIGINS = [
+    r"(https://[^.?#]*--pydis-forms\.netlify\.app)",  # Netlify Previews
+    r"(https?://[^.?#]*.forms-frontend.pages.dev)",  # Cloudflare Previews
+]
+if not constants.PRODUCTION:
+    # Add localhost to allowed origins on non-production deployments
+    ORIGINS.append(r"(https?://localhost:\d{0,4})")
+
+ALLOW_ORIGIN_REGEX = "|".join(ORIGINS)
+
 sentry_sdk.init(
     dsn=constants.FORMS_BACKEND_DSN,
     send_default_pii=True,
@@ -20,13 +30,13 @@ sentry_sdk.init(
 middleware = [
     Middleware(
         CORSMiddleware,
-        # TODO: Convert this into a RegEx that works for prod, netlify & previews
-        allow_origins=["*"],
+        allow_origins=["https://forms.pythondiscord.com"],
+        allow_origin_regex=ALLOW_ORIGIN_REGEX,
         allow_headers=[
-            "Authorization",
             "Content-Type"
         ],
-        allow_methods=["*"]
+        allow_methods=["*"],
+        allow_credentials=True
     ),
     Middleware(DatabaseMiddleware),
     Middleware(AuthenticationMiddleware, backend=JWTAuthenticationBackend()),
-- 
cgit v1.2.3


From c175279e4172160f0d119ddd93dce8a813fff69b Mon Sep 17 00:00:00 2001
From: Hassan Abouelela <47495861+HassanAbouelela@users.noreply.github.com>
Date: Mon, 1 Mar 2021 16:51:25 +0300
Subject: Allows All CORS Requests On Development

Signed-off-by: Hassan Abouelela <47495861+HassanAbouelela@users.noreply.github.com>
---
 backend/__init__.py | 4 ++--
 docker-compose.yml  | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

(limited to 'backend/__init__.py')

diff --git a/backend/__init__.py b/backend/__init__.py
index d56edfb..5c91a65 100644
--- a/backend/__init__.py
+++ b/backend/__init__.py
@@ -16,8 +16,8 @@ ORIGINS = [
     r"(https?://[^.?#]*.forms-frontend.pages.dev)",  # Cloudflare Previews
 ]
 if not constants.PRODUCTION:
-    # Add localhost to allowed origins on non-production deployments
-    ORIGINS.append(r"(https?://localhost:\d{0,4})")
+    # Allow all hosts on non-production deployments
+    ORIGINS.append(r"(.*)")
 
 ALLOW_ORIGIN_REGEX = "|".join(ORIGINS)
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 4e58ef7..8ee46be 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -37,3 +37,4 @@ services:
       - OAUTH2_CLIENT_SECRET
       - ALLOWED_URL
       - DEBUG=true
+      - PRODUCTION=false
-- 
cgit v1.2.3


From ca730082b523e62595687843a914adad8dbbaccf Mon Sep 17 00:00:00 2001
From: Hassan Abouelela <47495861+HassanAbouelela@users.noreply.github.com>
Date: Sat, 6 Mar 2021 22:48:19 +0300
Subject: Formats Authorize File

Cleans up the authorize file, and the __init__ to maintain the project's
 code style.

Co-authored-by: Joe Banks <joseph@josephbanks.me>
Signed-off-by: Hassan Abouelela <47495861+HassanAbouelela@users.noreply.github.com>
---
 backend/__init__.py              | 1 +
 backend/routes/auth/authorize.py | 5 ++---
 2 files changed, 3 insertions(+), 3 deletions(-)

(limited to 'backend/__init__.py')

diff --git a/backend/__init__.py b/backend/__init__.py
index 5c91a65..220b457 100644
--- a/backend/__init__.py
+++ b/backend/__init__.py
@@ -15,6 +15,7 @@ ORIGINS = [
     r"(https://[^.?#]*--pydis-forms\.netlify\.app)",  # Netlify Previews
     r"(https?://[^.?#]*.forms-frontend.pages.dev)",  # Cloudflare Previews
 ]
+
 if not constants.PRODUCTION:
     # Allow all hosts on non-production deployments
     ORIGINS.append(r"(.*)")
diff --git a/backend/routes/auth/authorize.py b/backend/routes/auth/authorize.py
index 98f9887..26d8622 100644
--- a/backend/routes/auth/authorize.py
+++ b/backend/routes/auth/authorize.py
@@ -21,6 +21,8 @@ from backend.discord import fetch_bearer_token, fetch_user_details
 from backend.route import Route
 from backend.validation import ErrorMessage, api
 
+AUTH_FAILURE = JSONResponse({"error": "auth_failure"}, status_code=400)
+
 
 class AuthorizeRequest(BaseModel):
     token: str = Field(description="The access token received from Discord.")
@@ -31,9 +33,6 @@ class AuthorizeResponse(BaseModel):
     expiry: str = Field("ISO formatted timestamp of expiry.")
 
 
-AUTH_FAILURE = JSONResponse({"error": "auth_failure"}, status_code=400)
-
-
 async def process_token(bearer_token: dict) -> Union[AuthorizeResponse, AUTH_FAILURE]:
     """Post a bearer token to Discord, and return a JWT and username."""
     interaction_start = datetime.datetime.now()
-- 
cgit v1.2.3