{-# LANGUAGE GADTs #-}
{-# LANGUAGE LambdaCase #-}
{-# LANGUAGE OverloadedStrings #-}
{-# LANGUAGE PatternGuards #-}
{-# LANGUAGE ScopedTypeVariables #-}
{-# LANGUAGE UnicodeSyntax #-}
module Network.Wai.Middleware.Cors
( Origin
, CorsResourcePolicy(..)
, simpleCorsResourcePolicy
, cors
, simpleCors
, isSimple
, simpleResponseHeaders
, simpleHeaders
, simpleContentTypes
, simpleMethods
) where
import Control.Monad.Error.Class
import Control.Monad.Trans.Except
import qualified Data.Attoparsec.ByteString.Char8 as P
import qualified Data.ByteString.Char8 as B8
import qualified Data.ByteString.Lazy.Char8 as LB8
import qualified Data.CaseInsensitive as CI
import Data.List (intersect, (\\), union)
import Data.Maybe (catMaybes)
import Data.Monoid.Unicode
import Data.String
import qualified Network.HTTP.Types as HTTP
import qualified Network.Wai as WAI
import Prelude.Unicode
type Origin = B8.ByteString
data CorsResourcePolicy = CorsResourcePolicy
{
CorsResourcePolicy -> Maybe ([Origin], Bool)
corsOrigins ∷ !(Maybe ([Origin], Bool))
, CorsResourcePolicy -> [Origin]
corsMethods ∷ ![HTTP.Method]
, ∷ ![HTTP.HeaderName]
, ∷ !(Maybe [HTTP.HeaderName])
, CorsResourcePolicy -> Maybe Int
corsMaxAge ∷ !(Maybe Int)
, CorsResourcePolicy -> Bool
corsVaryOrigin ∷ !Bool
, CorsResourcePolicy -> Bool
corsRequireOrigin ∷ !Bool
, CorsResourcePolicy -> Bool
corsIgnoreFailures ∷ !Bool
}
deriving (Int -> CorsResourcePolicy -> ShowS
[CorsResourcePolicy] -> ShowS
CorsResourcePolicy -> String
(Int -> CorsResourcePolicy -> ShowS)
-> (CorsResourcePolicy -> String)
-> ([CorsResourcePolicy] -> ShowS)
-> Show CorsResourcePolicy
forall a.
(Int -> a -> ShowS) -> (a -> String) -> ([a] -> ShowS) -> Show a
showList :: [CorsResourcePolicy] -> ShowS
$cshowList :: [CorsResourcePolicy] -> ShowS
show :: CorsResourcePolicy -> String
$cshow :: CorsResourcePolicy -> String
showsPrec :: Int -> CorsResourcePolicy -> ShowS
$cshowsPrec :: Int -> CorsResourcePolicy -> ShowS
Show,ReadPrec [CorsResourcePolicy]
ReadPrec CorsResourcePolicy
Int -> ReadS CorsResourcePolicy
ReadS [CorsResourcePolicy]
(Int -> ReadS CorsResourcePolicy)
-> ReadS [CorsResourcePolicy]
-> ReadPrec CorsResourcePolicy
-> ReadPrec [CorsResourcePolicy]
-> Read CorsResourcePolicy
forall a.
(Int -> ReadS a)
-> ReadS [a] -> ReadPrec a -> ReadPrec [a] -> Read a
readListPrec :: ReadPrec [CorsResourcePolicy]
$creadListPrec :: ReadPrec [CorsResourcePolicy]
readPrec :: ReadPrec CorsResourcePolicy
$creadPrec :: ReadPrec CorsResourcePolicy
readList :: ReadS [CorsResourcePolicy]
$creadList :: ReadS [CorsResourcePolicy]
readsPrec :: Int -> ReadS CorsResourcePolicy
$creadsPrec :: Int -> ReadS CorsResourcePolicy
Read,CorsResourcePolicy -> CorsResourcePolicy -> Bool
(CorsResourcePolicy -> CorsResourcePolicy -> Bool)
-> (CorsResourcePolicy -> CorsResourcePolicy -> Bool)
-> Eq CorsResourcePolicy
forall a. (a -> a -> Bool) -> (a -> a -> Bool) -> Eq a
/= :: CorsResourcePolicy -> CorsResourcePolicy -> Bool
$c/= :: CorsResourcePolicy -> CorsResourcePolicy -> Bool
== :: CorsResourcePolicy -> CorsResourcePolicy -> Bool
$c== :: CorsResourcePolicy -> CorsResourcePolicy -> Bool
Eq,Eq CorsResourcePolicy
Eq CorsResourcePolicy
-> (CorsResourcePolicy -> CorsResourcePolicy -> Ordering)
-> (CorsResourcePolicy -> CorsResourcePolicy -> Bool)
-> (CorsResourcePolicy -> CorsResourcePolicy -> Bool)
-> (CorsResourcePolicy -> CorsResourcePolicy -> Bool)
-> (CorsResourcePolicy -> CorsResourcePolicy -> Bool)
-> (CorsResourcePolicy -> CorsResourcePolicy -> CorsResourcePolicy)
-> (CorsResourcePolicy -> CorsResourcePolicy -> CorsResourcePolicy)
-> Ord CorsResourcePolicy
CorsResourcePolicy -> CorsResourcePolicy -> Bool
CorsResourcePolicy -> CorsResourcePolicy -> Ordering
CorsResourcePolicy -> CorsResourcePolicy -> CorsResourcePolicy
forall a.
Eq a
-> (a -> a -> Ordering)
-> (a -> a -> Bool)
-> (a -> a -> Bool)
-> (a -> a -> Bool)
-> (a -> a -> Bool)
-> (a -> a -> a)
-> (a -> a -> a)
-> Ord a
min :: CorsResourcePolicy -> CorsResourcePolicy -> CorsResourcePolicy
$cmin :: CorsResourcePolicy -> CorsResourcePolicy -> CorsResourcePolicy
max :: CorsResourcePolicy -> CorsResourcePolicy -> CorsResourcePolicy
$cmax :: CorsResourcePolicy -> CorsResourcePolicy -> CorsResourcePolicy
>= :: CorsResourcePolicy -> CorsResourcePolicy -> Bool
$c>= :: CorsResourcePolicy -> CorsResourcePolicy -> Bool
> :: CorsResourcePolicy -> CorsResourcePolicy -> Bool
$c> :: CorsResourcePolicy -> CorsResourcePolicy -> Bool
<= :: CorsResourcePolicy -> CorsResourcePolicy -> Bool
$c<= :: CorsResourcePolicy -> CorsResourcePolicy -> Bool
< :: CorsResourcePolicy -> CorsResourcePolicy -> Bool
$c< :: CorsResourcePolicy -> CorsResourcePolicy -> Bool
compare :: CorsResourcePolicy -> CorsResourcePolicy -> Ordering
$ccompare :: CorsResourcePolicy -> CorsResourcePolicy -> Ordering
$cp1Ord :: Eq CorsResourcePolicy
Ord)
simpleCorsResourcePolicy ∷ CorsResourcePolicy
simpleCorsResourcePolicy :: CorsResourcePolicy
simpleCorsResourcePolicy = CorsResourcePolicy :: Maybe ([Origin], Bool)
-> [Origin]
-> [HeaderName]
-> Maybe [HeaderName]
-> Maybe Int
-> Bool
-> Bool
-> Bool
-> CorsResourcePolicy
CorsResourcePolicy
{ corsOrigins :: Maybe ([Origin], Bool)
corsOrigins = Maybe ([Origin], Bool)
forall a. Maybe a
Nothing
, corsMethods :: [Origin]
corsMethods = [Origin]
simpleMethods
, corsRequestHeaders :: [HeaderName]
corsRequestHeaders = []
, corsExposedHeaders :: Maybe [HeaderName]
corsExposedHeaders = Maybe [HeaderName]
forall a. Maybe a
Nothing
, corsMaxAge :: Maybe Int
corsMaxAge = Maybe Int
forall a. Maybe a
Nothing
, corsVaryOrigin :: Bool
corsVaryOrigin = Bool
False
, corsRequireOrigin :: Bool
corsRequireOrigin = Bool
False
, corsIgnoreFailures :: Bool
corsIgnoreFailures = Bool
False
}
cors
∷ (WAI.Request → Maybe CorsResourcePolicy)
→ WAI.Middleware
cors :: (Request -> Maybe CorsResourcePolicy) -> Middleware
cors Request -> Maybe CorsResourcePolicy
policyPattern Application
app Request
r Response -> IO ResponseReceived
respond
| Request -> Bool
isWebSocketsReq Request
r = IO ResponseReceived
runApp
| Just CorsResourcePolicy
policy ← Request -> Maybe CorsResourcePolicy
policyPattern Request
r = case Maybe Origin
hdrOrigin of
Maybe Origin
Nothing → if CorsResourcePolicy -> Bool
corsRequireOrigin CorsResourcePolicy
policy
then Response -> IO ResponseReceived
res (Response -> IO ResponseReceived)
-> Response -> IO ResponseReceived
forall a b. (a -> b) -> a -> b
$ Origin -> Response
corsFailure Origin
"Origin header is missing"
else IO ResponseReceived
runApp
Just Origin
origin → CorsResourcePolicy -> Origin -> IO ResponseReceived
applyCorsPolicy CorsResourcePolicy
policy Origin
origin
| Bool
otherwise = IO ResponseReceived
runApp
where
res :: Response -> IO ResponseReceived
res = Response -> IO ResponseReceived
respond
runApp :: IO ResponseReceived
runApp = Application
app Request
r Response -> IO ResponseReceived
respond
hdrOrigin :: Maybe Origin
hdrOrigin = HeaderName -> [(HeaderName, Origin)] -> Maybe Origin
forall a b. Eq a => a -> [(a, b)] -> Maybe b
lookup HeaderName
"origin" (Request -> [(HeaderName, Origin)]
WAI.requestHeaders Request
r)
applyCorsPolicy :: CorsResourcePolicy -> Origin -> IO ResponseReceived
applyCorsPolicy CorsResourcePolicy
policy Origin
origin = do
let err :: String -> IO ResponseReceived
err String
e = if CorsResourcePolicy -> Bool
corsIgnoreFailures CorsResourcePolicy
policy
then IO ResponseReceived
runApp
else Response -> IO ResponseReceived
res (Response -> IO ResponseReceived)
-> Response -> IO ResponseReceived
forall a b. (a -> b) -> a -> b
$ Origin -> Response
corsFailure (String -> Origin
B8.pack String
e)
let respOriginOrErr :: Either String (Maybe (Origin, Bool))
respOriginOrErr = case CorsResourcePolicy -> Maybe ([Origin], Bool)
corsOrigins CorsResourcePolicy
policy of
Maybe ([Origin], Bool)
Nothing → Maybe (Origin, Bool) -> Either String (Maybe (Origin, Bool))
forall (m :: * -> *) a. Monad m => a -> m a
return Maybe (Origin, Bool)
forall a. Maybe a
Nothing
Just ([Origin]
originList, Bool
withCreds) → if Origin
origin Origin -> [Origin] -> Bool
forall (t :: * -> *) a. (Foldable t, Eq a) => a -> t a -> Bool
`elem` [Origin]
originList
then Maybe (Origin, Bool) -> Either String (Maybe (Origin, Bool))
forall a b. b -> Either a b
Right (Maybe (Origin, Bool) -> Either String (Maybe (Origin, Bool)))
-> Maybe (Origin, Bool) -> Either String (Maybe (Origin, Bool))
forall a b. (a -> b) -> a -> b
$ (Origin, Bool) -> Maybe (Origin, Bool)
forall a. a -> Maybe a
Just (Origin
origin, Bool
withCreds)
else String -> Either String (Maybe (Origin, Bool))
forall a b. a -> Either a b
Left (String -> Either String (Maybe (Origin, Bool)))
-> String -> Either String (Maybe (Origin, Bool))
forall a b. (a -> b) -> a -> b
$ String
"Unsupported origin: " String -> ShowS
forall α. Monoid α => α -> α -> α
⊕ Origin -> String
B8.unpack Origin
origin
case Either String (Maybe (Origin, Bool))
respOriginOrErr of
Left String
e → String -> IO ResponseReceived
err String
e
Right Maybe (Origin, Bool)
respOrigin → do
let ch :: [(HeaderName, Origin)]
ch = Maybe (Origin, Bool) -> Bool -> [(HeaderName, Origin)]
commonCorsHeaders Maybe (Origin, Bool)
respOrigin (CorsResourcePolicy -> Bool
corsVaryOrigin CorsResourcePolicy
policy)
case Request -> Origin
WAI.requestMethod Request
r of
Origin
"OPTIONS" → ExceptT String IO [(HeaderName, Origin)]
-> IO (Either String [(HeaderName, Origin)])
forall e (m :: * -> *) a. ExceptT e m a -> m (Either e a)
runExceptT (CorsResourcePolicy -> ExceptT String IO [(HeaderName, Origin)]
forall (μ :: * -> *).
(Functor μ, Monad μ) =>
CorsResourcePolicy -> ExceptT String μ [(HeaderName, Origin)]
preflightHeaders CorsResourcePolicy
policy) IO (Either String [(HeaderName, Origin)])
-> (Either String [(HeaderName, Origin)] -> IO ResponseReceived)
-> IO ResponseReceived
forall (m :: * -> *) a b. Monad m => m a -> (a -> m b) -> m b
>>= \case
Left String
e → String -> IO ResponseReceived
err String
e
Right [(HeaderName, Origin)]
headers → Response -> IO ResponseReceived
res (Response -> IO ResponseReceived)
-> Response -> IO ResponseReceived
forall a b. (a -> b) -> a -> b
$ Status -> [(HeaderName, Origin)] -> ByteString -> Response
WAI.responseLBS Status
HTTP.ok200 ([(HeaderName, Origin)]
ch [(HeaderName, Origin)]
-> [(HeaderName, Origin)] -> [(HeaderName, Origin)]
forall α. Monoid α => α -> α -> α
⊕ [(HeaderName, Origin)]
headers) ByteString
""
Origin
_ → [(HeaderName, Origin)] -> Middleware
addHeaders ([(HeaderName, Origin)]
ch [(HeaderName, Origin)]
-> [(HeaderName, Origin)] -> [(HeaderName, Origin)]
forall α. Monoid α => α -> α -> α
⊕ CorsResourcePolicy -> [(HeaderName, Origin)]
respCorsHeaders CorsResourcePolicy
policy) Application
app Request
r Response -> IO ResponseReceived
respond
preflightHeaders ∷ (Functor μ, Monad μ) ⇒ CorsResourcePolicy → ExceptT String μ HTTP.ResponseHeaders
preflightHeaders :: CorsResourcePolicy -> ExceptT String μ [(HeaderName, Origin)]
preflightHeaders CorsResourcePolicy
policy = [[(HeaderName, Origin)]] -> [(HeaderName, Origin)]
forall (t :: * -> *) a. Foldable t => t [a] -> [a]
concat ([[(HeaderName, Origin)]] -> [(HeaderName, Origin)])
-> ExceptT String μ [[(HeaderName, Origin)]]
-> ExceptT String μ [(HeaderName, Origin)]
forall (f :: * -> *) a b. Functor f => (a -> b) -> f a -> f b
<$> [ExceptT String μ [(HeaderName, Origin)]]
-> ExceptT String μ [[(HeaderName, Origin)]]
forall (t :: * -> *) (m :: * -> *) a.
(Traversable t, Monad m) =>
t (m a) -> m (t a)
sequence
[ CorsResourcePolicy -> ExceptT String μ [(HeaderName, Origin)]
forall (μ :: * -> *).
Monad μ =>
CorsResourcePolicy -> ExceptT String μ [(HeaderName, Origin)]
hdrReqMethod CorsResourcePolicy
policy
, CorsResourcePolicy -> ExceptT String μ [(HeaderName, Origin)]
forall (μ :: * -> *).
Monad μ =>
CorsResourcePolicy -> ExceptT String μ [(HeaderName, Origin)]
hdrRequestHeader CorsResourcePolicy
policy
, CorsResourcePolicy -> ExceptT String μ [(HeaderName, Origin)]
forall (μ :: * -> *).
Monad μ =>
CorsResourcePolicy -> ExceptT String μ [(HeaderName, Origin)]
hdrMaxAge CorsResourcePolicy
policy
]
hdrMaxAge ∷ Monad μ ⇒ CorsResourcePolicy → ExceptT String μ HTTP.ResponseHeaders
hdrMaxAge :: CorsResourcePolicy -> ExceptT String μ [(HeaderName, Origin)]
hdrMaxAge CorsResourcePolicy
policy = case CorsResourcePolicy -> Maybe Int
corsMaxAge CorsResourcePolicy
policy of
Maybe Int
Nothing → [(HeaderName, Origin)] -> ExceptT String μ [(HeaderName, Origin)]
forall (m :: * -> *) a. Monad m => a -> m a
return []
Just Int
secs → [(HeaderName, Origin)] -> ExceptT String μ [(HeaderName, Origin)]
forall (m :: * -> *) a. Monad m => a -> m a
return [(HeaderName
"Access-Control-Max-Age", Int -> Origin
forall α β. (IsString α, Show β) => β -> α
sshow Int
secs)]
hdrReqMethod ∷ Monad μ ⇒ CorsResourcePolicy → ExceptT String μ HTTP.ResponseHeaders
hdrReqMethod :: CorsResourcePolicy -> ExceptT String μ [(HeaderName, Origin)]
hdrReqMethod CorsResourcePolicy
policy = case HeaderName -> [(HeaderName, Origin)] -> Maybe Origin
forall a b. Eq a => a -> [(a, b)] -> Maybe b
lookup HeaderName
"Access-Control-Request-Method" (Request -> [(HeaderName, Origin)]
WAI.requestHeaders Request
r) of
Maybe Origin
Nothing → String -> ExceptT String μ [(HeaderName, Origin)]
forall e (m :: * -> *) a. MonadError e m => e -> m a
throwError String
"Access-Control-Request-Method header is missing in CORS preflight request"
Just Origin
x → if Origin
x Origin -> [Origin] -> Bool
forall (t :: * -> *) a. (Foldable t, Eq a) => a -> t a -> Bool
`elem` [Origin]
supportedMethods
then [(HeaderName, Origin)] -> ExceptT String μ [(HeaderName, Origin)]
forall (m :: * -> *) a. Monad m => a -> m a
return [(HeaderName
"Access-Control-Allow-Methods", [Origin] -> Origin
hdrL [Origin]
supportedMethods)]
else String -> ExceptT String μ [(HeaderName, Origin)]
forall e (m :: * -> *) a. MonadError e m => e -> m a
throwError
(String -> ExceptT String μ [(HeaderName, Origin)])
-> String -> ExceptT String μ [(HeaderName, Origin)]
forall a b. (a -> b) -> a -> b
$ String
"Method requested in Access-Control-Request-Method of CORS request is not supported; requested: "
String -> ShowS
forall α. Monoid α => α -> α -> α
⊕ Origin -> String
B8.unpack Origin
x
String -> ShowS
forall α. Monoid α => α -> α -> α
⊕ String
"; supported are "
String -> ShowS
forall α. Monoid α => α -> α -> α
⊕ Origin -> String
B8.unpack ([Origin] -> Origin
hdrL [Origin]
supportedMethods)
String -> ShowS
forall α. Monoid α => α -> α -> α
⊕ String
"."
where
supportedMethods :: [Origin]
supportedMethods = CorsResourcePolicy -> [Origin]
corsMethods CorsResourcePolicy
policy [Origin] -> [Origin] -> [Origin]
forall a. Eq a => [a] -> [a] -> [a]
`union` [Origin]
simpleMethods
hdrRequestHeader ∷ Monad μ ⇒ CorsResourcePolicy → ExceptT String μ HTTP.ResponseHeaders
hdrRequestHeader :: CorsResourcePolicy -> ExceptT String μ [(HeaderName, Origin)]
hdrRequestHeader CorsResourcePolicy
policy = case HeaderName -> [(HeaderName, Origin)] -> Maybe Origin
forall a b. Eq a => a -> [(a, b)] -> Maybe b
lookup HeaderName
"Access-Control-Request-Headers" (Request -> [(HeaderName, Origin)]
WAI.requestHeaders Request
r) of
Maybe Origin
Nothing → [(HeaderName, Origin)] -> ExceptT String μ [(HeaderName, Origin)]
forall (m :: * -> *) a. Monad m => a -> m a
return []
Just Origin
hdrsBytes → do
[HeaderName]
hdrs ← (String -> ExceptT String μ [HeaderName])
-> ([HeaderName] -> ExceptT String μ [HeaderName])
-> Either String [HeaderName]
-> ExceptT String μ [HeaderName]
forall a c b. (a -> c) -> (b -> c) -> Either a b -> c
either String -> ExceptT String μ [HeaderName]
forall e (m :: * -> *) a. MonadError e m => e -> m a
throwError [HeaderName] -> ExceptT String μ [HeaderName]
forall (m :: * -> *) a. Monad m => a -> m a
return (Either String [HeaderName] -> ExceptT String μ [HeaderName])
-> Either String [HeaderName] -> ExceptT String μ [HeaderName]
forall a b. (a -> b) -> a -> b
$ Parser [HeaderName] -> Origin -> Either String [HeaderName]
forall a. Parser a -> Origin -> Either String a
P.parseOnly Parser [HeaderName]
httpHeaderNameListParser Origin
hdrsBytes
if [HeaderName]
hdrs [HeaderName] -> [HeaderName] -> Bool
forall α. Eq α => [α] -> [α] -> Bool
`isSubsetOf` [HeaderName]
supportedHeaders
then [(HeaderName, Origin)] -> ExceptT String μ [(HeaderName, Origin)]
forall (m :: * -> *) a. Monad m => a -> m a
return [(HeaderName
"Access-Control-Allow-Headers", [HeaderName] -> Origin
hdrLI [HeaderName]
supportedHeaders)]
else String -> ExceptT String μ [(HeaderName, Origin)]
forall e (m :: * -> *) a. MonadError e m => e -> m a
throwError
(String -> ExceptT String μ [(HeaderName, Origin)])
-> String -> ExceptT String μ [(HeaderName, Origin)]
forall a b. (a -> b) -> a -> b
$ String
"HTTP header requested in Access-Control-Request-Headers of CORS request is not supported; requested: "
String -> ShowS
forall α. Monoid α => α -> α -> α
⊕ Origin -> String
B8.unpack ([HeaderName] -> Origin
hdrLI [HeaderName]
hdrs)
String -> ShowS
forall α. Monoid α => α -> α -> α
⊕ String
"; supported are "
String -> ShowS
forall α. Monoid α => α -> α -> α
⊕ Origin -> String
B8.unpack ([HeaderName] -> Origin
hdrLI [HeaderName]
supportedHeaders)
String -> ShowS
forall α. Monoid α => α -> α -> α
⊕ String
"."
where
supportedHeaders :: [HeaderName]
supportedHeaders = CorsResourcePolicy -> [HeaderName]
corsRequestHeaders CorsResourcePolicy
policy [HeaderName] -> [HeaderName] -> [HeaderName]
forall a. Eq a => [a] -> [a] -> [a]
`union` [HeaderName]
simpleHeadersWithoutContentType
simpleHeadersWithoutContentType :: [HeaderName]
simpleHeadersWithoutContentType = [HeaderName]
simpleHeaders [HeaderName] -> [HeaderName] -> [HeaderName]
forall a. Eq a => [a] -> [a] -> [a]
\\ [HeaderName
"content-type"]
commonCorsHeaders ∷ Maybe (Origin, Bool) → Bool → HTTP.ResponseHeaders
commonCorsHeaders :: Maybe (Origin, Bool) -> Bool -> [(HeaderName, Origin)]
commonCorsHeaders Maybe (Origin, Bool)
Nothing Bool
_ = [(HeaderName
"Access-Control-Allow-Origin", Origin
"*")]
commonCorsHeaders (Just (Origin
o, Bool
creds)) Bool
vary = []
[(HeaderName, Origin)]
-> [(HeaderName, Origin)] -> [(HeaderName, Origin)]
forall α. Monoid α => α -> α -> α
⊕ (Bool
True Bool -> (HeaderName, Origin) -> [(HeaderName, Origin)]
forall (f :: * -> *) a.
(Applicative f, Monoid (f a)) =>
Bool -> a -> f a
?? (HeaderName
"Access-Control-Allow-Origin", Origin
o))
[(HeaderName, Origin)]
-> [(HeaderName, Origin)] -> [(HeaderName, Origin)]
forall α. Monoid α => α -> α -> α
⊕ (Bool
creds Bool -> (HeaderName, Origin) -> [(HeaderName, Origin)]
forall (f :: * -> *) a.
(Applicative f, Monoid (f a)) =>
Bool -> a -> f a
?? (HeaderName
"Access-Control-Allow-Credentials", Origin
"true"))
[(HeaderName, Origin)]
-> [(HeaderName, Origin)] -> [(HeaderName, Origin)]
forall α. Monoid α => α -> α -> α
⊕ (Bool
vary Bool -> (HeaderName, Origin) -> [(HeaderName, Origin)]
forall (f :: * -> *) a.
(Applicative f, Monoid (f a)) =>
Bool -> a -> f a
?? (HeaderName
"Vary", Origin
"Origin"))
where
?? :: Bool -> a -> f a
(??) Bool
a a
b = if Bool
a then a -> f a
forall (f :: * -> *) a. Applicative f => a -> f a
pure a
b else f a
forall a. Monoid a => a
mempty
respCorsHeaders ∷ CorsResourcePolicy → HTTP.ResponseHeaders
respCorsHeaders :: CorsResourcePolicy -> [(HeaderName, Origin)]
respCorsHeaders CorsResourcePolicy
policy = [Maybe (HeaderName, Origin)] -> [(HeaderName, Origin)]
forall a. [Maybe a] -> [a]
catMaybes
[ ([HeaderName] -> (HeaderName, Origin))
-> Maybe [HeaderName] -> Maybe (HeaderName, Origin)
forall (f :: * -> *) a b. Functor f => (a -> b) -> f a -> f b
fmap (\[HeaderName]
x → (HeaderName
"Access-Control-Expose-Headers", [HeaderName] -> Origin
hdrLI [HeaderName]
x)) (CorsResourcePolicy -> Maybe [HeaderName]
corsExposedHeaders CorsResourcePolicy
policy)
]
simpleCors ∷ WAI.Middleware
simpleCors :: Middleware
simpleCors = (Request -> Maybe CorsResourcePolicy) -> Middleware
cors (Maybe CorsResourcePolicy -> Request -> Maybe CorsResourcePolicy
forall a b. a -> b -> a
const (Maybe CorsResourcePolicy -> Request -> Maybe CorsResourcePolicy)
-> Maybe CorsResourcePolicy -> Request -> Maybe CorsResourcePolicy
forall a b. (a -> b) -> a -> b
$ CorsResourcePolicy -> Maybe CorsResourcePolicy
forall a. a -> Maybe a
Just CorsResourcePolicy
simpleCorsResourcePolicy)
simpleResponseHeaders ∷ [HTTP.HeaderName]
=
[ HeaderName
"Cache-Control"
, HeaderName
"Content-Language"
, HeaderName
"Content-Type"
, HeaderName
"Expires"
, HeaderName
"Last-Modified"
, HeaderName
"Pragma"
]
simpleHeaders ∷ [HTTP.HeaderName]
=
[ HeaderName
"Accept"
, HeaderName
"Accept-Language"
, HeaderName
"Content-Language"
, HeaderName
"Content-Type"
]
simpleContentTypes ∷ [CI.CI B8.ByteString]
simpleContentTypes :: [HeaderName]
simpleContentTypes =
[ HeaderName
"application/x-www-form-urlencoded"
, HeaderName
"multipart/form-data"
, HeaderName
"text/plain"
]
simpleMethods ∷ [HTTP.Method]
simpleMethods :: [Origin]
simpleMethods =
[ Origin
"GET"
, Origin
"HEAD"
, Origin
"POST"
]
isSimple ∷ HTTP.Method → HTTP.RequestHeaders → Bool
isSimple :: Origin -> [(HeaderName, Origin)] -> Bool
isSimple Origin
method [(HeaderName, Origin)]
headers
= Origin
method Origin -> [Origin] -> Bool
forall (t :: * -> *) a. (Foldable t, Eq a) => a -> t a -> Bool
`elem` [Origin]
simpleMethods
Bool -> Bool -> Bool
∧ ((HeaderName, Origin) -> HeaderName)
-> [(HeaderName, Origin)] -> [HeaderName]
forall a b. (a -> b) -> [a] -> [b]
map (HeaderName, Origin) -> HeaderName
forall a b. (a, b) -> a
fst [(HeaderName, Origin)]
headers [HeaderName] -> [HeaderName] -> Bool
forall α. Eq α => [α] -> [α] -> Bool
`isSubsetOf` [HeaderName]
simpleHeaders
Bool -> Bool -> Bool
∧ case (Origin
method, HeaderName -> [(HeaderName, Origin)] -> Maybe Origin
forall a b. Eq a => a -> [(a, b)] -> Maybe b
lookup HeaderName
"content-type" [(HeaderName, Origin)]
headers) of
(Origin
"POST", Just Origin
x) → Origin -> HeaderName
forall s. FoldCase s => s -> CI s
CI.mk Origin
x HeaderName -> [HeaderName] -> Bool
forall (t :: * -> *) a. (Foldable t, Eq a) => a -> t a -> Bool
`elem` [HeaderName]
simpleContentTypes
(Origin, Maybe Origin)
_ → Bool
True
isHttpHeaderNameChar ∷ Char → Bool
Char
c = (Char
c Char -> Char -> Bool
forall α. Ord α => α -> α -> Bool
≥ Int -> Char
forall a. Enum a => Int -> a
toEnum Int
33) Bool -> Bool -> Bool
&& (Char
c Char -> Char -> Bool
forall α. Ord α => α -> α -> Bool
≤ Int -> Char
forall a. Enum a => Int -> a
toEnum Int
126) Bool -> Bool -> Bool
&& String -> Char -> Bool
P.notInClass String
"()<>@,;:\\\"/[]?={}" Char
c
httpHeaderNameParser ∷ P.Parser HTTP.HeaderName
= String -> HeaderName
forall a. IsString a => String -> a
fromString (String -> HeaderName) -> Parser Origin String -> Parser HeaderName
forall (f :: * -> *) a b. Functor f => (a -> b) -> f a -> f b
<$> Parser Origin Char -> Parser Origin String
forall (f :: * -> *) a. Alternative f => f a -> f [a]
P.many1 ((Char -> Bool) -> Parser Origin Char
P.satisfy Char -> Bool
isHttpHeaderNameChar) Parser HeaderName -> String -> Parser HeaderName
forall i a. Parser i a -> String -> Parser i a
P.<?> String
"HTTP Header Name"
httpHeaderNameListParser ∷ P.Parser [HTTP.HeaderName]
= Parser Origin String
spaces Parser Origin String -> Parser [HeaderName] -> Parser [HeaderName]
forall (f :: * -> *) a b. Applicative f => f a -> f b -> f b
*> Parser HeaderName -> Parser Origin Char -> Parser [HeaderName]
forall (f :: * -> *) a s. Alternative f => f a -> f s -> f [a]
P.sepBy (Parser HeaderName
httpHeaderNameParser Parser HeaderName -> Parser Origin String -> Parser HeaderName
forall (f :: * -> *) a b. Applicative f => f a -> f b -> f a
<* Parser Origin String
spaces) (Char -> Parser Origin Char
P.char Char
',') Parser [HeaderName] -> Parser Origin String -> Parser [HeaderName]
forall (f :: * -> *) a b. Applicative f => f a -> f b -> f a
<* Parser Origin String
spaces
where
spaces :: Parser Origin String
spaces = Parser Origin Char -> Parser Origin String
forall (m :: * -> *) a. MonadPlus m => m a -> m [a]
P.many' Parser Origin Char
P.space
sshow ∷ (IsString α, Show β) ⇒ β → α
sshow :: β -> α
sshow = String -> α
forall a. IsString a => String -> a
fromString (String -> α) -> (β -> String) -> β -> α
forall β γ α. (β -> γ) -> (α -> β) -> α -> γ
∘ β -> String
forall a. Show a => a -> String
show
isSubsetOf ∷ Eq α ⇒ [α] → [α] → Bool
isSubsetOf :: [α] -> [α] -> Bool
isSubsetOf [α]
l1 [α]
l2 = [α] -> [α] -> [α]
forall a. Eq a => [a] -> [a] -> [a]
intersect [α]
l1 [α]
l2 [α] -> [α] -> Bool
forall α. Eq α => α -> α -> Bool
≡ [α]
l1
addHeaders ∷ HTTP.ResponseHeaders → WAI.Middleware
[(HeaderName, Origin)]
hdrs Application
app Request
req Response -> IO ResponseReceived
respond = Application
app Request
req ((Response -> IO ResponseReceived) -> IO ResponseReceived)
-> (Response -> IO ResponseReceived) -> IO ResponseReceived
forall a b. (a -> b) -> a -> b
$ \Response
response → do
let (Status
st, [(HeaderName, Origin)]
headers, (StreamingBody -> IO ResponseReceived) -> IO ResponseReceived
streamHandle) = Response
-> (Status, [(HeaderName, Origin)],
(StreamingBody -> IO ResponseReceived) -> IO ResponseReceived)
forall a.
Response
-> (Status, [(HeaderName, Origin)],
(StreamingBody -> IO a) -> IO a)
WAI.responseToStream Response
response
(StreamingBody -> IO ResponseReceived) -> IO ResponseReceived
streamHandle ((StreamingBody -> IO ResponseReceived) -> IO ResponseReceived)
-> (StreamingBody -> IO ResponseReceived) -> IO ResponseReceived
forall a b. (a -> b) -> a -> b
$ \StreamingBody
streamBody →
Response -> IO ResponseReceived
respond (Response -> IO ResponseReceived)
-> Response -> IO ResponseReceived
forall a b. (a -> b) -> a -> b
$ Status -> [(HeaderName, Origin)] -> StreamingBody -> Response
WAI.responseStream Status
st ([(HeaderName, Origin)]
headers [(HeaderName, Origin)]
-> [(HeaderName, Origin)] -> [(HeaderName, Origin)]
forall α. Monoid α => α -> α -> α
⊕ [(HeaderName, Origin)]
hdrs) StreamingBody
streamBody
hdrLI ∷ [HTTP.HeaderName] → B8.ByteString
hdrLI :: [HeaderName] -> Origin
hdrLI [HeaderName]
l = Origin -> [Origin] -> Origin
B8.intercalate Origin
", " ((HeaderName -> Origin) -> [HeaderName] -> [Origin]
forall a b. (a -> b) -> [a] -> [b]
map HeaderName -> Origin
forall s. CI s -> s
CI.original [HeaderName]
l)
hdrL ∷ [B8.ByteString] → B8.ByteString
hdrL :: [Origin] -> Origin
hdrL = Origin -> [Origin] -> Origin
B8.intercalate Origin
", "
corsFailure
∷ B8.ByteString
→ WAI.Response
corsFailure :: Origin -> Response
corsFailure Origin
msg = Status -> [(HeaderName, Origin)] -> ByteString -> Response
WAI.responseLBS Status
HTTP.status400 [(HeaderName
"Content-Type", Origin
"text/html; charset-utf-8")] (Origin -> ByteString
LB8.fromStrict Origin
msg)
isWebSocketsReq
∷ WAI.Request
→ Bool
isWebSocketsReq :: Request -> Bool
isWebSocketsReq Request
req =
(Origin -> HeaderName) -> Maybe Origin -> Maybe HeaderName
forall (f :: * -> *) a b. Functor f => (a -> b) -> f a -> f b
fmap Origin -> HeaderName
forall s. FoldCase s => s -> CI s
CI.mk (HeaderName -> [(HeaderName, Origin)] -> Maybe Origin
forall a b. Eq a => a -> [(a, b)] -> Maybe b
lookup HeaderName
"upgrade" ([(HeaderName, Origin)] -> Maybe Origin)
-> [(HeaderName, Origin)] -> Maybe Origin
forall a b. (a -> b) -> a -> b
$ Request -> [(HeaderName, Origin)]
WAI.requestHeaders Request
req) Maybe HeaderName -> Maybe HeaderName -> Bool
forall α. Eq α => α -> α -> Bool
== HeaderName -> Maybe HeaderName
forall a. a -> Maybe a
Just HeaderName
"websocket"