fix(core): enable CORS on the asset protocol, closes #2965 (#2974)

Author: lucasfernog

.changes/asset-cors.md

@@ -0,0 +1,5 @@
+---
+"tauri": patch
+---
+
+Enable CORS on the `asset` protocol.

core/tauri/src/manager.rs

@@ -303,6 +303,17 @@ impl<R: Runtime> WindowManager<R> {
       registered_scheme_protocols.push("tauri".into());
     }
     if !registered_scheme_protocols.contains(&"asset".into()) {
+      let window_url = Url::parse(&pending.url).unwrap();
+      let window_origin = format!(
+        "{}://{}{}",
+        window_url.scheme(),
+        window_url.host().unwrap(),
+        if let Some(port) = window_url.port() {
+          format!(":{}", port)
+        } else {
+          "".into()
+        }
+      );
       pending.register_uri_scheme_protocol("asset", move |request| {
         #[cfg(target_os = "windows")]
         let path = request.uri().replace("asset://localhost/", "");
@@ -313,11 +324,13 @@ impl<R: Runtime> WindowManager<R> {
           .to_string();
         let path_for_data = path.clone();
 
+        let mut response =
+          HttpResponseBuilder::new().header("Access-Control-Allow-Origin", &window_origin);
+
         // handle 206 (partial range) http request
         if let Some(range) = request.headers().get("range").cloned() {
           let mut status_code = 200;
           let path_for_data = path_for_data.clone();
-          let mut response = HttpResponseBuilder::new();
           let (headers, status_code, data) = crate::async_runtime::safe_block_on(async move {
             let mut headers = HashMap::new();
             let mut buf = Vec::new();
@@ -371,10 +384,14 @@ impl<R: Runtime> WindowManager<R> {
           }
         }
 
-        let data =
-          crate::async_runtime::safe_block_on(async move { tokio::fs::read(path_for_data).await })?;
-        let mime_type = MimeType::parse(&data, &path);
-        HttpResponseBuilder::new().mimetype(&mime_type).body(data)
+        if let Ok(data) =
+          crate::async_runtime::safe_block_on(async move { tokio::fs::read(path_for_data).await })
+        {
+          let mime_type = MimeType::parse(&data, &path);
+          response.mimetype(&mime_type).body(data)
+        } else {
+          response.status(404).body(Vec::new())
+        }
       });
     }
 
@@ -634,6 +651,8 @@ impl<R: Runtime> WindowManager<R> {
       _ => unimplemented!(),
     };
 
+    pending.url = url;
+
     if is_local {
       let label = pending.label.clone();
       pending = self.prepare_pending_window(pending, &label, pending_labels, app_handle.clone())?;
@@ -644,8 +663,6 @@ impl<R: Runtime> WindowManager<R> {
       pending.file_drop_handler = Some(self.prepare_file_drop(app_handle));
     }
 
-    pending.url = url;
-
     // in `Windows`, we need to force a data_directory
     // but we do respect user-specification
     #[cfg(target_os = "windows")]