From 35c719cf77095e8e826f9ce6643e8bde713ec6ad Mon Sep 17 00:00:00 2001
From: Ravi Sawlani <152961362+ravi-sawlani-yral@users.noreply.github.com>
Date: Thu, 30 Jan 2025 21:52:32 +0530
Subject: [PATCH] feat: add cors for preview link urls (#641)

* add cors for preview link urls

* fix dependency issue

* fix dependency issue

* allow yral.com in cors policy
---
 ssr/Cargo.toml                  |  2 +-
 ssr/src/main.rs                 | 14 +++++++++++++-
 ssr/src/page/google_redirect.rs |  9 ++-------
 ssr/src/utils/host.rs           | 13 +++++++++++++
 4 files changed, 29 insertions(+), 9 deletions(-)

diff --git a/ssr/Cargo.toml b/ssr/Cargo.toml
index 82f729fd4..f55e4bd80 100644
--- a/ssr/Cargo.toml
+++ b/ssr/Cargo.toml
@@ -22,7 +22,7 @@ tokio = { version = "1", optional = true, features = [
     "time",
 ] }
 tower = { version = "0.4", optional = true }
-tower-http = { version = "0.5", features = ["fs"], optional = true }
+tower-http = { version = "0.5", features = ["fs", "cors"], optional = true }
 wasm-bindgen = "=0.2.93"
 thiserror = "1.0"
 tracing = { version = "0.1.37", optional = true }
diff --git a/ssr/src/main.rs b/ssr/src/main.rs
index 8b0171677..b0fa5a327 100644
--- a/ssr/src/main.rs
+++ b/ssr/src/main.rs
@@ -5,11 +5,14 @@ use axum::{
     response::{IntoResponse, Response},
 };
 use axum::{routing::get, Router};
-use hot_or_not_web_leptos_ssr::fallback::file_and_error_handler;
 use hot_or_not_web_leptos_ssr::{app::App, init::AppStateBuilder, state::server::AppState};
+use hot_or_not_web_leptos_ssr::{
+    fallback::file_and_error_handler, utils::host::is_host_a_preview_link,
+};
 use leptos::{get_configuration, logging::log, provide_context};
 use leptos_axum::handle_server_fns_with_context;
 use leptos_axum::{generate_route_list, LeptosRoutes};
+use tower_http::cors::{AllowOrigin, CorsLayer};
 
 pub async fn server_fn_handler(
     State(app_state): State<AppState>,
@@ -139,6 +142,15 @@ async fn main() {
             "/api/*fn_name",
             get(server_fn_handler).post(server_fn_handler),
         )
+        .layer(
+            CorsLayer::new().allow_origin(AllowOrigin::predicate(|origin, _| {
+                if let Ok(host) = origin.to_str() {
+                    is_host_a_preview_link(host) || host == "yral.com"
+                } else {
+                    false
+                }
+            })),
+        )
         .leptos_routes_with_handler(routes, get(leptos_routes_handler))
         .fallback(file_and_error_handler)
         .with_state(res.app_state);
diff --git a/ssr/src/page/google_redirect.rs b/ssr/src/page/google_redirect.rs
index f303d2ee1..eef9b7465 100644
--- a/ssr/src/page/google_redirect.rs
+++ b/ssr/src/page/google_redirect.rs
@@ -51,8 +51,7 @@ async fn preview_google_auth_redirector() -> Result<(), ServerFnError> {
 
 #[cfg(feature = "ssr")]
 fn is_valid_redirect_uri_inner(client_redirect_uri: &str) -> Option<()> {
-    use regex::Regex;
-    use std::sync::LazyLock;
+    use crate::utils::host::is_host_a_preview_link;
 
     let parsed_uri = http::Uri::try_from(client_redirect_uri).ok()?;
 
@@ -65,11 +64,7 @@ fn is_valid_redirect_uri_inner(client_redirect_uri: &str) -> Option<()> {
         return Some(());
     }
 
-    static PR_PREVIEW_PATTERN: LazyLock<Regex> = LazyLock::new(|| {
-        Regex::new(r"^pr-\d*-yral-dapp-hot-or-not-web-leptos-ssr\.fly\.dev$").unwrap()
-    });
-
-    PR_PREVIEW_PATTERN.is_match_at(host, 0).then_some(())
+    is_host_a_preview_link(host).then_some(())
 }
 
 #[cfg(feature = "ssr")]
diff --git a/ssr/src/utils/host.rs b/ssr/src/utils/host.rs
index d738e0a5b..6e71ac9d5 100644
--- a/ssr/src/utils/host.rs
+++ b/ssr/src/utils/host.rs
@@ -1,3 +1,5 @@
+use std::sync::LazyLock;
+
 pub fn get_host() -> String {
     #[cfg(feature = "hydrate")]
     {
@@ -24,6 +26,17 @@ pub fn show_cdao_page() -> bool {
     show_cdao_condition(host)
 }
 
+#[cfg(feature = "ssr")]
+pub fn is_host_a_preview_link(host: &str) -> bool {
+    use regex::Regex;
+
+    static PR_PREVIEW_PATTERN: LazyLock<Regex> = LazyLock::new(|| {
+        Regex::new(r"^pr-\d*-yral-dapp-hot-or-not-web-leptos-ssr\.fly\.dev$").unwrap()
+    });
+
+    PR_PREVIEW_PATTERN.is_match_at(host, 0)
+}
+
 pub fn show_preview_component() -> bool {
     let host = get_host();
     host.contains("yral-dapp-hot-or-not-web-leptos-ssr.fly.dev")