Merge torrust#218: Add environment variable to set permissive CORS po…

…licy

f998d9d feat: add env var to set permissive CORS policy (Jose Celano)

Pull request description:

  Running the backend with:

  ```
  TORRUST_IDX_BACK_CORS_PERMISSIVE=true cargo run
  ```

  will make the CORS policy to be permissive, which means you can use a different port for the API and serving the frontend app. It's intented for development purposes.

Top commit has no ACKs.

Tree-SHA512: eda45426fb6e6aeceb7213066354a3d9b83de6a3d3e757788e5500c84c2900f6d15f16c95c1b82ae763c487847827c9592859e206a41feb37eec4755a9ea8ff9

src/bootstrap/config.rs

@@ -12,6 +12,9 @@ pub const ENV_VAR_CONFIG: &str = "TORRUST_IDX_BACK_CONFIG";
 /// The `config.toml` file location.
 pub const ENV_VAR_CONFIG_PATH: &str = "TORRUST_IDX_BACK_CONFIG_PATH";
 
+/// If present, CORS will be permissive.
+pub const ENV_VAR_CORS_PERMISSIVE: &str = "TORRUST_IDX_BACK_CORS_PERMISSIVE";
+
 // Default values
 
 pub const ENV_VAR_DEFAULT_CONFIG_PATH: &str = "./config.toml";

src/web/api/v1/routes.rs

@@ -1,13 +1,14 @@
 //! Route initialization for the v1 API.
+use std::env;
 use std::sync::Arc;
 
 use axum::routing::get;
 use axum::Router;
+use tower_http::cors::CorsLayer;
 
 use super::contexts::about::handlers::about_page_handler;
-//use tower_http::cors::CorsLayer;
-use super::contexts::{about, proxy, settings, tag, torrent};
-use super::contexts::{category, user};
+use super::contexts::{about, category, proxy, settings, tag, torrent, user};
+use crate::bootstrap::config::ENV_VAR_CORS_PERMISSIVE;
 use crate::common::AppData;
 
 pub const API_VERSION_URL_PREFIX: &str = "v1";
@@ -30,14 +31,13 @@ pub fn router(app_data: Arc<AppData>) -> Router {
         .nest("/torrents", torrent::routes::router_for_multiple_resources(app_data.clone()))
         .nest("/proxy", proxy::routes::router(app_data.clone()));
 
-    Router::new()
+    let router = Router::new()
         .route("/", get(about_page_handler).with_state(app_data))
-        .nest(&format!("/{API_VERSION_URL_PREFIX}"), v1_api_routes)
-    // For development purposes only.
-    //
-    //.layer(CorsLayer::permissive()) // Uncomment this line and the `use` import.
-    //
-    // It allows calling the API on a different port. For example
-    // API: http://localhost:3000/v1
-    // Webapp: http://localhost:8080
+        .nest(&format!("/{API_VERSION_URL_PREFIX}"), v1_api_routes);
+
+    if env::var(ENV_VAR_CORS_PERMISSIVE).is_ok() {
+        router.layer(CorsLayer::permissive())
+    } else {
+        router
+    }
 }