feat(martin-server): add support for basic CORS configuration

.dockerignore

@@ -17,6 +17,7 @@ demo/
 .DS_Store
 target/
 **/*.rs.bk
+.aider*
 .idea/
 .vscode/
 test_log*

.gitignore

@@ -5,6 +5,7 @@
 .DS_Store
 target/
 **/*.rs.bk
+.aider*
 .idea/
 .vscode/
 test_log*

docs/src/config-file.md

@@ -44,6 +44,19 @@ preferred_encoding: gzip
 # Enable or disable Martin web UI. At the moment, only allows `enable-for-all` which enables the web UI for all connections. This may be undesirable in a production environment. [default: disable]
 web_ui: disable
 
+# CORS Configuration
+#
+# Defaults to `cors: true`, which allows all origins.
+# Sending/Acting on CORS headers can be completely disabled via `cors: false`
+cors:
+  # Sets the `Access-Control-Allow-Origin` header [default: *]
+  # '*' will use the requests `ORIGIN` header
+  origin:
+    - https://example.org
+  # Sets `Access-Control-Max-Age` Header. [default: null]
+  # null means not setting the header for preflight requests
+  max_age: 3600
+
 # Database configuration. This can also be a list of PG configs.
 postgres:
   # Database connection string.

martin/src/srv/config.rs

@@ -1,5 +1,6 @@
 use serde::{Deserialize, Serialize};
 
+use super::cors::CorsConfig;
 use crate::args::PreferredEncoding;
 
 pub const KEEP_ALIVE_DEFAULT: u64 = 75;
@@ -15,13 +16,15 @@ pub struct SrvConfig {
     pub preferred_encoding: Option<PreferredEncoding>,
     #[cfg(feature = "webui")]
     pub web_ui: Option<crate::args::WebUiMode>,
+    pub cors: Option<CorsConfig>,
 }
 
 #[cfg(test)]
 mod tests {
     use indoc::indoc;
 
     use super::*;
+    use crate::srv::cors::CorsProperties;
     use crate::tests::some;
 
     #[test]
@@ -73,4 +76,65 @@ mod tests {
             }
         );
     }
+
+    #[test]
+    fn parse_config_cors() {
+        assert_eq!(
+            serde_yaml::from_str::<SrvConfig>(indoc! {"
+                keep_alive: 75
+                listen_addresses: '0.0.0.0:3000'
+                worker_processes: 8
+                cors: false
+            "})
+            .unwrap(),
+            SrvConfig {
+                keep_alive: Some(75),
+                listen_addresses: some("0.0.0.0:3000"),
+                worker_processes: Some(8),
+                cors: Some(CorsConfig::SimpleFlag(false)),
+                ..Default::default()
+            }
+        );
+        assert_eq!(
+            serde_yaml::from_str::<SrvConfig>(indoc! {"
+                keep_alive: 75
+                listen_addresses: '0.0.0.0:3000'
+                worker_processes: 8
+                cors: true
+            "})
+            .unwrap(),
+            SrvConfig {
+                keep_alive: Some(75),
+                listen_addresses: some("0.0.0.0:3000"),
+                worker_processes: Some(8),
+                cors: Some(CorsConfig::SimpleFlag(true)),
+                ..Default::default()
+            }
+        );
+        assert_eq!(
+            serde_yaml::from_str::<SrvConfig>(indoc! {"
+                keep_alive: 75
+                listen_addresses: '0.0.0.0:3000'
+                worker_processes: 8
+                cors:
+                  origin:
+                    - https://martin.maplibre.org
+                    - https://example.org
+            "})
+            .unwrap(),
+            SrvConfig {
+                keep_alive: Some(75),
+                listen_addresses: some("0.0.0.0:3000"),
+                worker_processes: Some(8),
+                cors: Some(CorsConfig::Properties(CorsProperties {
+                    origin: vec![
+                        "https://martin.maplibre.org".to_string(),
+                        "https://example.org".to_string()
+                    ],
+                    max_age: None,
+                })),
+                ..Default::default()
+            }
+        );
+    }
 }