Support allowedOrigins config option for CORS

src/cors.js

@@ -0,0 +1,17 @@
+const config = require('config');
+
+module.exports = async (ctx, next) => {
+	if (ctx.headers.origin) {
+		let allowedOrigins = config.get('allowedOrigins').filter(x => x);
+		console.log(config.get('allowedOrigins'));
+		console.log(allowedOrigins);
+		let allAllowed = allowedOrigins.includes('*');
+		if (allAllowed || allowedOrigins.includes(ctx.headers.origin)) {
+			ctx.set("Access-Control-Allow-Origin", allAllowed ? '*' : ctx.headers.origin);
+			ctx.set("Access-Control-Allow-Methods", "POST, GET, OPTIONS");
+			ctx.set("Access-Control-Allow-Headers", "Content-Type");
+			ctx.set("Access-Control-Expose-Headers", "Link");
+		}
+	}
+	await next();
+};

src/lambda.js

@@ -26,6 +26,7 @@
 const Koa = require('koa');
 const _ = require('koa-route');
 const bodyParser = require('koa-bodyparser');
+const cors = require('./cors');
 const serverless = require('serverless-http');
 
 require('./zotero');
@@ -36,6 +37,7 @@ const WebEndpoint = require('./webEndpoint');
 const ExportEndpoint = require('./exportEndpoint');
 
 const app = module.exports = new Koa();
+app.use(cors);
 app.use(bodyParser({enableTypes: ['text', 'json']}));
 app.use(_.post('/web', WebEndpoint.handle.bind(WebEndpoint)));
 app.use(_.post('/search', SearchEndpoint.handle.bind(SearchEndpoint)));

src/server.js

@@ -28,6 +28,7 @@ const config = require('config');
 const Koa = require('koa');
 const _ = require('koa-route');
 const bodyParser = require('koa-bodyparser');
+const cors = require('./cors');
 
 require('./zotero');
 const Debug = require('./debug');
@@ -37,6 +38,7 @@ const WebEndpoint = require('./webEndpoint');
 const ExportEndpoint = require('./exportEndpoint');
 
 const app = module.exports = new Koa();
+app.use(cors);
 app.use(bodyParser({ enableTypes: ['text', 'json']}));
 app.use(_.post('/web', WebEndpoint.handle.bind(WebEndpoint)));
 app.use(_.post('/search', SearchEndpoint.handle.bind(SearchEndpoint)));