Add option to disable CORS support on endpoints

Author: jthomas

README.md

@@ -837,6 +837,16 @@ This feature comes with the following restrictions:
 - *Path parameters are only supported when `resp` is configured as`http`.*
 - *Individual path parameter values are not included as separate event parameters. Users have to manually parse values from the full `__ow_path` value.*
 
+### CORS Support
+
+API Gateway endpoints automatically include CORS headers for all endpoints under the service base path. This property can be disabled by manually configuring the `resources.apigw.cors` property.
+
+```yaml
+resources:
+    apigw:
+        cors: false
+```
+
 ## Exporting Web Actions
 
 Functions can be turned into "*web actions*" which return HTTP content without use of an API Gateway. This feature is enabled by setting an annotation (`web-export`) in the configuration file.

compile/apigw/index.js

@@ -92,6 +92,17 @@ class OpenWhiskCompileHttpEvents {
     return options;
   }
 
+    /**
+  parseOptionalConfigParams (httpEvent) {
+    const options = {} 
+    if (httpEvent.hasOwnProperty('cors')) {
+      options.cors = httpEvent.cors
+    }
+
+    return options
+  }
+  */
+
   parseHttpEvent(httpEvent) {
     if (httpEvent.path && httpEvent.method) {
       return { relpath: httpEvent.path, operation: httpEvent.method, responsetype: httpEvent.resp || 'json' };

compile/apigw/tests/index.js

@@ -189,6 +189,19 @@ describe('OpenWhiskCompileHttpEvents', () => {
       return expect(result).to.deep.equal({basepath: '/my-service', relpath: '/api/foo/bar', operation: 'GET', action: '/sample_ns/my-service_action-name', responsetype: 'http'});
     });
 
+    /**
+    it('should define http events with optional API GW parameters', () => {
+      openwhiskCompileHttpEvents.serverless.service.service = 'my-service' 
+      openwhiskCompileHttpEvents.serverless.service.provider = {namespace: "sample_ns"};
+      const http =  {path: "/api/foo/bar", method: "GET", cors: true}
+      let result = openwhiskCompileHttpEvents.compileHttpEvent('action-name', {}, http);
+      expect(result.options).to.deep.equal({cors: true});
+      http.cors = false
+      result = openwhiskCompileHttpEvents.compileHttpEvent('action-name', {}, http);
+      expect(result.options).to.deep.equal({cors: false});
+    });
+    */
+
     it('should throw if http event value invalid', () => {
       expect(() => openwhiskCompileHttpEvents.compileHttpEvent('', {}, 'OPERATION'))
         .to.throw(Error, /Incorrect HTTP event/);

deploy/lib/deployApiGw.js

@@ -21,6 +21,35 @@ module.exports = {
     });
   },
 
+  // should only do this if config exists....
+  updateRoutesConfig (basepath, config) {
+    return this.provider.client().then(ow => {
+      if (this.options.verbose) {
+        this.serverless.cli.log(`Retrieving API Gateway Route Config: ${basepath} ${JSON.stringify(config)}`);
+      }
+      return ow.routes.get({basepath: basepath })
+        .then(response => {
+          const route = response.apis[0]
+          if (!route) return BbPromise.resolve()
+
+          const swagger = route.value.apidoc
+          if (this.options.verbose) {
+            this.serverless.cli.log(`Retrieved API Gateway Route Config: ${JSON.stringify(swagger)}`);
+          }
+          const updated_swagger = this.configRouteSwagger(swagger, config)
+
+          if (this.options.verbose) {
+            this.serverless.cli.log(`Updating API Gateway Route Config: ${JSON.stringify(updated_swagger)}`);
+          }
+          return ow.routes.create({swagger: updated_swagger})
+        }).catch(err => {
+          throw new this.serverless.classes.Error(
+            `Failed to update API Gateway route config (${basepath}) due to error: ${err.message}`
+          );
+        })
+    });
+  },
+
   unbindAllRoutes() {
     return new Promise((resolve) => {
       this.provider.client()
@@ -30,6 +59,31 @@ module.exports = {
     })
   },
 
+  configRouteSwagger(swagger, options) {
+    const merged = Object.assign({}, swagger)
+
+    if (!merged.hasOwnProperty('x-ibm-configuration')) {
+      merged['x-ibm-configuration'] = {}
+    }
+
+    if (options.hasOwnProperty('cors')) {
+      merged['x-ibm-configuration'].cors = { enabled: options.cors }
+    }
+
+    return merged
+  },
+
+  deployOptionalRoutesConfig() {
+    const resources = this.serverless.service.resources || {}
+    if (resources.hasOwnProperty('apigw')) {
+      this.serverless.cli.log('Configuring API Gateway options...');
+      const basepath = `/${this.serverless.service.service}`
+      return this.updateRoutesConfig(basepath, resources.apigw)
+    }
+
+    return BbPromise.resolve();
+  },
+
   deploySequentialRoutes(routes) {
       return BbPromise.mapSeries(routes, r => this.deployRoute(r))
   },
@@ -44,5 +98,6 @@ module.exports = {
     this.serverless.cli.log('Deploying API Gateway definitions...');
     return this.unbindAllRoutes()
       .then(() => this.deploySequentialRoutes(apigw))
+      .then(() => this.deployOptionalRoutesConfig(apigw))
   }
 };

deploy/tests/deployApiGw.js

@@ -3,6 +3,7 @@ const expect = require('chai').expect;
 const OpenWhiskDeploy = require('../index');
 const sinon = require('sinon');
 const chaiAsPromised = require('chai-as-promised');
+const fs = require('fs');
 
 require('chai').use(chaiAsPromised);
 
@@ -34,6 +35,32 @@ describe('deployHttpEvents', () => {
     sandbox.restore();
   });
 
+  describe('#deployOptionalRoutesConfig()', () => {
+    it('should not call API GW unless config present', () => {
+      sandbox.stub(openwhiskDeploy.provider, 'client', () => Promise.reject('No config present!'))
+      return expect(openwhiskDeploy.deployOptionalRoutesConfig())
+        .to.eventually.be.fulfilled;
+    })
+
+    it('should call API GW when config present', () => {
+      let called = false
+      sandbox.stub(openwhiskDeploy, 'updateRoutesConfig', (basepath, config) => {
+        called = true
+        expect(basepath).to.be.equal('/my-service')
+        expect(config).to.be.deep.equal(openwhiskDeploy.serverless.service.resources.apigw)
+        return Promise.resolve({})
+      });
+
+      openwhiskDeploy.serverless.service.resources = {
+        apigw: { cors: true }
+      }
+      const result = openwhiskDeploy.deployOptionalRoutesConfig()
+
+      result.then(() => expect(called).to.be.equal(true))
+      return expect(result).to.eventually.be.fulfilled;
+    })
+  })
+
   describe('#unbindAllRoutes()', () => {
     it('should deploy api gw route handler to openwhisk', () => {
       sandbox.stub(openwhiskDeploy.provider, 'client', () => {
@@ -60,7 +87,62 @@ describe('deployHttpEvents', () => {
     });
 
   });
-  
+
+  describe('#configRouteSwagger()', () => {
+    it('should update swagger with CORS config parameter', () => {
+      const source = fs.readFileSync('./deploy/tests/resources/swagger.json', 'utf-8')
+      const swagger = JSON.parse(source)
+      const options = { cors: false }
+      let result = openwhiskDeploy.configRouteSwagger(swagger, options)
+      expect(result['x-ibm-configuration'].cors.enabled).to.be.equal(false)
+
+      swagger['x-ibm-configuration'].cors.enabled = false
+      options.cors = true
+      result = openwhiskDeploy.configRouteSwagger(swagger, options)
+      expect(result['x-ibm-configuration'].cors.enabled).to.be.equal(true)
+    })
+
+    it('should maintain existing swagger config parameters', () => {
+      const source = fs.readFileSync('./deploy/tests/resources/swagger.json', 'utf-8')
+      const swagger = JSON.parse(source)
+      swagger['x-ibm-configuration'].test = 'value'
+      const options = { cors: false }
+      let result = openwhiskDeploy.configRouteSwagger(swagger, options)
+      expect(result['x-ibm-configuration'].test).to.be.equal('value')
+    })
+
+    it('should leave swagger the same without config parameters', () => {
+      const source = fs.readFileSync('./deploy/tests/resources/swagger.json', 'utf-8')
+      const swagger = JSON.parse(source)
+      const options = { }
+      const result = openwhiskDeploy.configRouteSwagger(swagger, options)
+      expect(result).to.be.deep.equal(swagger)
+    })
+  })
+
+  describe('#updateRouteConfig()', () => {
+    it('should retrieve and deploy updated api gw route swagger to openwhisk', () => {
+      const source = fs.readFileSync('./deploy/tests/resources/swagger.json', 'utf-8')
+      const swagger = JSON.parse(source)
+
+      sandbox.stub(openwhiskDeploy.provider, 'client', () => {
+        const get = params => {
+          expect(params).to.be.deep.equal({basepath: '/my-service'});
+          return Promise.resolve({ apis: [{value: {apidoc:swagger}}]});
+        };
+
+        const create = params => {
+          expect(params.swagger).to.be.deep.equal(swagger);
+          return Promise.resolve({});
+        };
+
+        return Promise.resolve({ routes: { get: get, create: create } });
+      });
+      return expect(openwhiskDeploy.updateRoutesConfig('/my-service', {random: false}))
+        .to.eventually.be.fulfilled;
+    });
+  });
+ 
   describe('#deploySequentialRoutes()', () => {
     it('should deploy each route in sequential order', () => {
       let inflight = 0

deploy/tests/resources/swagger.json

@@ -0,0 +1,66 @@
+{
+    "swagger": "2.0",
+    "basePath": "/testing",
+    "info": {
+        "title": "testing",
+        "version": "1.0"
+    },
+    "paths": {
+        "/testing": {
+            "get": {
+                "operationId": "getTesting",
+                "responses": {
+                    "200": {
+                        "description": "A successful invocation response"
+                    }
+                },
+                "x-openwhisk": {
+                    "action": "hello",
+                    "namespace": "user@host.com_dev",
+                    "package": "default",
+                    "url": "https://openwhisk/api/v1/web/user@host.com_dev/default/hello.json"
+                }
+            }
+        }
+    },
+    "x-ibm-configuration": {
+        "assembly": {
+            "execute": [
+                {
+                    "operation-switch": {
+                        "case": [
+                            {
+                                "execute": [
+                                    {
+                                        "set-variable": {
+                                            "actions": [
+                                                {
+                                                    "set": "message.headers.X-Require-Whisk-Auth",
+                                                    "value": "3b08f67e-c7fa-4998-9096-ffa355932a3d"
+                                                }
+                                            ]
+                                        }
+                                    },
+                                    {
+                                        "invoke": {
+                                            "target-url": "https://openwhisk/api/v1/web/user@host.com_dev/default/hello.json",
+                                            "verb": "keep"
+                                        }
+                                    }
+                                ],
+                                "operations": [
+                                    "getTesting"
+                                ]
+                            }
+                        ],
+                        "otherwise": [],
+                        "title": "whisk-invoke"
+                    }
+                }
+            ]
+        },
+        "cors": {
+            "enabled": true
+        }
+    }
+}