From bde658f6044daeb5830e27098623ed3937147a92 Mon Sep 17 00:00:00 2001
From: John Ferlito <johnf@inodes.org>
Date: Thu, 17 Oct 2024 17:48:13 +1100
Subject: [PATCH] Add cors to API

---
 Gemfile                     | 1 +
 Gemfile.lock                | 3 +++
 config/initializers/cors.rb | 7 +++++++
 3 files changed, 11 insertions(+)
 create mode 100644 config/initializers/cors.rb

diff --git a/Gemfile b/Gemfile
index 29be1e3e..3d01e47a 100644
--- a/Gemfile
+++ b/Gemfile
@@ -111,6 +111,7 @@ gem 'roo' # Spreadsheet interface
 gem 'roo-xls' # Add excel support to roo
 gem 'rubyzip' # Zip the large CSV files before emailing
 gem 'rufus-scheduler' # Cron
+gem 'rack-cors' # API
 
 group :development, :test do
   gem 'rails-controller-testing'
diff --git a/Gemfile.lock b/Gemfile.lock
index 5005aab9..17efdc87 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -389,6 +389,8 @@ GEM
     raabro (1.4.0)
     racc (1.8.1)
     rack (3.1.7)
+    rack-cors (2.0.2)
+      rack (>= 2.0.0)
     rack-session (2.0.0)
       rack (>= 3.0.0)
     rack-test (2.1.0)
@@ -694,6 +696,7 @@ DEPENDENCIES
   opensearch-ruby
   paper_trail
   puma (>= 5.0)
+  rack-cors
   rails (~> 7.2.0)
   rails-controller-testing
   rails-reverse-proxy
diff --git a/config/initializers/cors.rb b/config/initializers/cors.rb
new file mode 100644
index 00000000..5e995aee
--- /dev/null
+++ b/config/initializers/cors.rb
@@ -0,0 +1,7 @@
+Rails.application.config.middleware.insert_before 0, Rack::Cors do
+  allow do
+    origins '*'
+    resource '/oauth/token', headers: :any, methods: [:post]
+    resource '/api/v1/oni/*', headers: :any, methods: [:get]
+  end
+end