Allow cors spec to be defined as regexps

[matteosuppo]

If the string passed into Origin() begins and ends with a "/"
it's considered a regular expression.

For example "/[api|swagger].goa.design/" can match both
api.goa.design and swagger.goa.design

Fix #718

Signed-off-by: Matteo Suppo matteo.suppo@gmail.com

[raphael]

Thank you, this is a great PR! I'm wondering though if there's a way we could avoid having to recompile the regexp on every request. Maybe we could introduce a MatchOriginRegexp function in the cors package that accepts a regular expression for the origin parameter. The generated code would compile the regexp once when mounting the action.

[matteosuppo]

Sounds reasonable

[matteosuppo]

It could generate something like:

func handleBoardsOrigin(h goa.Handler) goa.Handler {
    spec := regexp.MustCompile("[api|swagger].goa.design")
    return func(ctx context.Context, rw http.ResponseWriter, req *http.Request) error {
        origin := req.Header.Get("Origin")
        if origin == "" {
            // Not a CORS request
            return h(ctx, rw, req)
        }
        if cors.MatchOriginRegexp(origin, spec) {
            ctx = goa.WithLogContext(ctx, "origin", origin)
            rw.Header().Set("Access-Control-Allow-Origin", origin)
            rw.Header().Set("Access-Control-Allow-Credentials", "true")
            if acrm := req.Header.Get("Access-Control-Request-Method"); acrm != "" {
                // We are handling a preflight request
                rw.Header().Set("Access-Control-Allow-Methods", "GET, PUT, POST, DELETE")
                rw.Header().Set("Access-Control-Allow-Headers", "Authorization, Origin, X-Requested-With, Content-Type, Accept")
            }
            return h(ctx, rw, req)
        }

        return h(ctx, rw, req)
    }
}

[matteosuppo]

Tomorrow I'll fix the tests

[raphael]

Great, thanks. Generated code snippet looks good.

[raphael]

Bonus points for adding a test for the generated code as well :)

[raphael]

Awesome PR, thank you!