OONI Auth and Run prod (#883)

* Add run.ooni.org to valid fqdn

* Tighten up cors settings

* Cleanup origins passing

* Fix missing middleware argument

api/ooniapi/auth.py

@@ -249,6 +249,7 @@ def validate_redirect_url(rt_url: str) -> Tuple[str, str]:
         "explorer.ooni.org",
         "explorer.test.ooni.org",
         "run.ooni.io",
+        "run.ooni.org",
         "run.test.ooni.org",
         "run-v2.ooni.org",
         "test-lists.ooni.org",

ooniapi/services/ooniauth/src/ooniauth/main.py

@@ -38,11 +38,9 @@ async def lifespan(app: FastAPI):
     app, metric_namespace="ooniapi", metric_subsystem="ooniauth"
 )
 
-# TODO: temporarily enable all
-origins = ["*"]
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=origins,
+    allow_origin_regex="^https://[-A-Za-z0-9]+(\.test)?\.ooni\.(org|io)$",
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],

ooniapi/services/ooniauth/src/ooniauth/utils.py

@@ -12,6 +12,7 @@
     "explorer.ooni.org",
     "explorer.test.ooni.org",
     "run.ooni.io",
+    "run.ooni.org",
     "run.test.ooni.org",
     "run-v2.ooni.org",
     "test-lists.ooni.org",

ooniapi/services/oonifindings/src/oonifindings/main.py

@@ -37,11 +37,9 @@ async def lifespan(app: FastAPI):
     app, metric_namespace="ooniapi", metric_subsystem="oonifindings"
 )
 
-# TODO: temporarily enable all
-origins = ["*"]
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=origins,
+    allow_origin_regex="^https://[-A-Za-z0-9]+(\.test)?\.ooni\.(org|io)$",
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],

ooniapi/services/oonimeasurements/src/oonimeasurements/main.py

@@ -39,11 +39,9 @@ async def lifespan(app: FastAPI):
     app, metric_namespace="ooniapi", metric_subsystem="oonimeasurements"
 )
 
-# TODO: temporarily enable all
-origins = ["*"]
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=origins,
+    allow_origin_regex="^https://[-A-Za-z0-9]+(\.test)?\.ooni\.(org|io)$",
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],

ooniapi/services/ooniprobe/src/ooniprobe/main.py

@@ -37,11 +37,9 @@ async def lifespan(app: FastAPI):
     app, metric_namespace="ooniapi", metric_subsystem="ooniprobe"
 )
 
-# TODO: temporarily enable all
-origins = ["*"]
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=origins,
+    allow_origin_regex="^https://[-A-Za-z0-9]+(\.test)?\.ooni\.(org|io)$",
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],

ooniapi/services/oonirun/src/oonirun/main.py

@@ -38,11 +38,9 @@ async def lifespan(app: FastAPI):
     app, metric_namespace="ooniapi", metric_subsystem="oonirun"
 )
 
-# TODO: temporarily enable all
-origins = ["*"]
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=origins,
+    allow_origin_regex="^https://[-A-Za-z0-9]+(\.test)?\.ooni\.(org|io)$",
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],