Merge remote-tracking branch 'knewter/feature/allow_api_access'

app/controllers/application_controller.rb

@@ -8,8 +8,10 @@ class ApplicationController < ActionController::Base
 
   before_action :set_context
   before_action :clear_setting_cache
+  before_action :cors_preflight_check
   before_action "hook(:app_before_filter, self)"
   after_action "hook(:app_after_filter,  self)"
+  after_action :cors_set_access_control_headers
 
   helper_method :current_user_session, :current_user, :can_signup?
   helper_method :called_from_index_page?, :called_from_landing_page?
@@ -253,4 +255,22 @@ def redirection_url
             login_url
     end
   end
+
+  def cors_set_access_control_headers
+    headers['Access-Control-Allow-Origin'] = '*'
+    headers['Access-Control-Allow-Methods'] = 'POST, GET, PUT, DELETE, OPTIONS'
+    headers['Access-Control-Allow-Headers'] = 'Origin, Content-Type, Accept, Authorization, Token'
+    headers['Access-Control-Max-Age'] = "1728000"
+  end
+
+  def cors_preflight_check
+    if request.method == 'OPTIONS'
+      headers['Access-Control-Allow-Origin'] = '*'
+      headers['Access-Control-Allow-Methods'] = 'POST, GET, PUT, DELETE, OPTIONS'
+      headers['Access-Control-Allow-Headers'] = 'X-Requested-With, X-Prototype-Version, Token'
+      headers['Access-Control-Max-Age'] = '1728000'
+
+      render :text => '', :content_type => 'text/plain'
+    end
+  end
 end

app/models/users/authentication.rb

@@ -6,6 +6,7 @@
 class Authentication < Authlogic::Session::Base # NOTE: This is not ActiveRecord model.
   authenticate_with User
   after_save :check_if_suspended
+  single_access_allowed_request_types :any
 
   def to_key
     id ? id : nil