chore: Implemented CORS handling for nwaku REST server (#2470)

* Add allowOrigin configuration for wakunode and WakuRestServer
Update nim-presto to the latest master that contains middleware support
Rework Rest Server in waku to utilize chronos' and presto's new middleware design and added proper CORS handling.
Added cors tests and fixes

Co-authored-by: Ivan FB <128452529+Ivansete-status@users.noreply.github.com>

apps/wakunode2/app.nim

@@ -84,7 +84,7 @@ type
     node: WakuNode
 
     rpcServer: Option[RpcHttpServer]
-    restServer: Option[RestServerRef]
+    restServer: Option[WakuRestServerRef]
     metricsServer: Option[MetricsHttpServerRef]
 
   AppResult*[T] = Result[T, string]
@@ -667,34 +667,55 @@ proc startApp*(app: var App): AppResult[void] =
 
 ## Monitoring and external interfaces
 
-proc startRestServer(app: App, address: IpAddress, port: Port, conf: WakuNodeConf): AppResult[RestServerRef] =
+proc startRestServer(app: App,
+                    address: IpAddress,
+                    port: Port,
+                    conf: WakuNodeConf):
+                    AppResult[WakuRestServerRef] =
 
   # Used to register api endpoints that are not currently installed as keys,
   # values are holding error messages to be returned to the client
   var notInstalledTab: Table[string, string] = initTable[string, string]()
 
-  proc requestErrorHandler(error: RestRequestError,
-                                request: HttpRequestRef):
-                                Future[HttpResponseRef] {.async.} =
-    case error
-    of RestRequestError.Invalid:
-      return await request.respond(Http400, "Invalid request", HttpTable.init())
-    of RestRequestError.NotFound:
-      let rootPath = request.rawPath.split("/")[1]
-      if notInstalledTab.hasKey(rootPath):
-        return await request.respond(Http404, notInstalledTab[rootPath], HttpTable.init())
-      else:
-        return await request.respond(Http400, "Bad request initiated. Invalid path or method used.", HttpTable.init())
-    of RestRequestError.InvalidContentBody:
-      return await request.respond(Http400, "Invalid content body", HttpTable.init())
-    of RestRequestError.InvalidContentType:
-      return await request.respond(Http400, "Invalid content type", HttpTable.init())
-    of RestRequestError.Unexpected:
-      return defaultResponse()
+  let requestErrorHandler : RestRequestErrorHandler = proc (error: RestRequestError,
+                           request: HttpRequestRef):
+                                Future[HttpResponseRef]
+                                {.async: (raises: [CancelledError]).} =
+    try:
+      case error
+      of RestRequestError.Invalid:
+        return await request.respond(Http400, "Invalid request", HttpTable.init())
+      of RestRequestError.NotFound:
+        let paths = request.rawPath.split("/")
+        let rootPath = if len(paths) > 1:
+                         paths[1]
+                       else:
+                          ""
+        notInstalledTab.withValue(rootPath, errMsg):
+          return await request.respond(Http404, errMsg[], HttpTable.init())
+        do:
+          return await request.respond(Http400, "Bad request initiated. Invalid path or method used.", HttpTable.init())
+      of RestRequestError.InvalidContentBody:
+        return await request.respond(Http400, "Invalid content body", HttpTable.init())
+      of RestRequestError.InvalidContentType:
+        return await request.respond(Http400, "Invalid content type", HttpTable.init())
+      of RestRequestError.Unexpected:
+        return defaultResponse()
+    except HttpWriteError:
+      error "Failed to write response to client", error = getCurrentExceptionMsg()
+      discard
 
     return defaultResponse()
 
-  let server = ? newRestHttpServer(address, port, requestErrorHandler = requestErrorHandler)
+  let allowedOrigin = if len(conf.restAllowOrigin) > 0 :
+                        some(conf.restAllowOrigin.join(","))
+                      else:
+                        none(string)
+
+  let server = ? newRestHttpServer(address, port,
+                                   allowedOrigin = allowedOrigin,
+                                   requestErrorHandler = requestErrorHandler)
+
   ## Admin REST API
   if conf.restAdmin:
     installAdminApiHandlers(server.router, app.node)

apps/wakunode2/external_config.nim

@@ -419,6 +419,14 @@ type
         defaultValue: false
         name: "rest-private" }: bool
 
+      restAllowOrigin* {.
+        desc: "Allow cross-origin requests from the specified origin." &
+              "Argument may be repeated." &
+              "Wildcards: * or ? allowed." &
+              "Ex.: \"localhost:*\" or \"127.0.0.1:8080\"",
+        defaultValue: newSeq[string]()
+        name: "rest-allow-origin" }: seq[string]
+
       ## Metrics config
 
       metricsServer* {.

tests/all_tests_waku.nim

@@ -85,7 +85,8 @@ import
   ./wakunode_rest/test_rest_filter,
   ./wakunode_rest/test_rest_legacy_filter,
   ./wakunode_rest/test_rest_lightpush,
-  ./wakunode_rest/test_rest_admin
+  ./wakunode_rest/test_rest_admin,
+  ./wakunode_rest/test_rest_cors
 
 import
   ./waku_rln_relay/test_waku_rln_relay,

tests/wakunode_rest/test_all.nim

@@ -10,4 +10,5 @@ import
   ./test_rest_relay,
   ./test_rest_serdes,
   ./test_rest_store,
-  ./test_rest_admin
+  ./test_rest_admin,
+  ./test_rest_cors

tests/wakunode_rest/test_rest_admin.nim

@@ -30,7 +30,7 @@ suite "Waku v2 Rest API - Admin":
   var peerInfo1 {.threadvar.}: RemotePeerInfo
   var peerInfo2 {.threadvar.}: RemotePeerInfo
   var peerInfo3 {.threadvar.}: RemotePeerInfo
-  var restServer {.threadvar.}: RestServerRef
+  var restServer {.threadvar.}: WakuRestServerRef
   var client{.threadvar.}: RestClientRef
 
   asyncSetup:
@@ -46,7 +46,7 @@ suite "Waku v2 Rest API - Admin":
 
     let restPort = Port(58011)
     let restAddress = parseIpAddress("127.0.0.1")
-    restServer = RestServerRef.init(restAddress, restPort).tryGet()
+    restServer = WakuRestServerRef.init(restAddress, restPort).tryGet()
 
     installAdminApiHandlers(restServer.router, node1)