add validation to allowed-origins to include path

[nicksrandall]

The use-case here is that we store our assets in AWS S3 and we'd like to restrict access to a certain bucket.

So, instead of starting service using -allowed-origins https://s3.amazonaws.com flag which isn't very useful in our case because this would allow anybody to use our service with any asset on s3, we could instead extend the allowed origins to something like -allowed-origins https://s3.amazonaws.com/some_bucket/.

Then, if a request comes in to fetch image at url https://s3.amazonaws.com/some_bucket/path/image.jpg, we would complete this request because it contains the host and basepath listed in allowed origins.

If the request had asked for https://s3.amazonaws.com/different_bucket/path/image.jpg or https://s3.different-origin.com/some_bucket/path/image.jpg the request would fail because host and basepath did not match an allowed origin.

[Dynom]

Hi,

First thanks for your contribution!

A couple of considerations for this PR:

1. It's missing test-coverage, I'll see if I can chip in on that.
2. Configuration might require some additional legwork (for safety, one might want to be explicit regarding the ending /, for a situation regarding example.org/foo/ versus example.org/foobar.png). I think we can add something for that to parseOrigins
3. It's worth noting that configuration becomes slightly more complicated in terms of collisions. Something we might want to add to the documentation (order is significant in the current configuration: *.example.org/,foo.example.org/assets is an easy mistake to make)

[nicksrandall]

@Dynom thanks for your help! I have merged your tests into this PR and they are all passing. Is there anything else I can do to help get this PR merged? I also added some documentation to README to help explain how this logic works.

[nicksrandall]

I’m not sure if this is automated or not but after this PR gets merged, would it be possible to push a new Docker image to Docker registry?

[nicksrandall]

I don't intend to sound rude or impatient as I know that this is an open source project and the maintainers likely have day jobs. That said, would it be possible to estimate when this change might be able to land? I'm trying to plan a release around this feature.

[h2non]

New release v1.1.1 is now available. See:
https://github.com/h2non/imaginary/releases/tag/v1.1.1

[Dynom]

@nicksrandall no offence taken. I fully understand the frustration, but it's exactly as you said it.

The new Docker image is also available. Enjoy the release and thanks again for your contribution!