fix cors with PUT methods

crates/lib/actix_cors_configs/src/cors.rs

@@ -65,7 +65,7 @@ fn do_build_cors_config(is_production: bool) -> Cors {
   }
 
   // Remaining setup
-  cors.allowed_methods(vec!["GET", "POST", "OPTIONS", "DELETE"])
+  cors.allowed_methods(vec!["GET", "POST", "PUT", "OPTIONS", "DELETE"])
       .supports_credentials()
       .allowed_headers(vec![
         actix_http::header::ACCEPT,
@@ -84,9 +84,31 @@ mod tests {
 
   use crate::testing::assert_origin_invalid;
   use crate::testing::assert_origin_ok;
+  use crate::testing::assert_preflight_method_invalid;
+  use crate::testing::assert_preflight_method_ok;
 
   use super::build_cors_config;
 
+  #[actix_rt::test]
+  async fn test_preflight_allows_every_supported_method() {
+    let production_cors = build_cors_config(ServerEnvironment::Production);
+
+    // PUT is used by e.g. the folders routes (rename/star/color_code/cover_image).
+    for method in ["GET", "POST", "PUT", "DELETE"] {
+      assert_preflight_method_ok(&production_cors, "https://app.getartcraft.com", method).await;
+      assert_preflight_method_ok(&production_cors, "https://storyteller.ai", method).await;
+    }
+  }
+
+  #[actix_rt::test]
+  async fn test_preflight_rejects_unsupported_methods() {
+    let production_cors = build_cors_config(ServerEnvironment::Production);
+
+    for method in ["PATCH", "TRACE", "CONNECT"] {
+      assert_preflight_method_invalid(&production_cors, "https://app.getartcraft.com", method).await;
+    }
+  }
+
   #[actix_rt::test]
   async fn test_fakeyou_production() {
     let production_cors = build_cors_config(ServerEnvironment::Production);

crates/lib/actix_cors_configs/src/testing.rs

@@ -2,6 +2,7 @@ use actix_cors::Cors;
 use actix_http::body::{BoxBody, EitherBody};
 use actix_http::StatusCode;
 use actix_web::dev::{ServiceResponse, Transform};
+use actix_web::http::Method;
 use actix_web::test;
 use actix_web::test::TestRequest;
 use speculoos::asserting;
@@ -20,6 +21,23 @@ pub (crate) async fn assert_origin_invalid(cors: &Cors, hostname: &str) {
       .is_equal_to(StatusCode::BAD_REQUEST);
 }
 
+/// Assert that a CORS preflight (OPTIONS + Access-Control-Request-Method)
+/// for the given method is accepted from the given origin.
+pub (crate) async fn assert_preflight_method_ok(cors: &Cors, hostname: &str, method: &str) {
+  let response = make_preflight_request(cors, hostname, method).await;
+  asserting(&format!("Preflight for {} from {} is allowed", method, hostname))
+      .that(&response.status())
+      .is_equal_to(StatusCode::OK);
+}
+
+/// Assert that a CORS preflight for the given method is rejected.
+pub (crate) async fn assert_preflight_method_invalid(cors: &Cors, hostname: &str, method: &str) {
+  let response = make_preflight_request(cors, hostname, method).await;
+  asserting(&format!("Preflight for {} from {} is rejected", method, hostname))
+      .that(&response.status())
+      .is_equal_to(StatusCode::BAD_REQUEST);
+}
+
 async fn make_test_request(cors: &Cors, hostname: &str) -> ServiceResponse<EitherBody<BoxBody>> {
   let cors= cors.new_transform(test::ok_service())
       .await
@@ -31,3 +49,21 @@ async fn make_test_request(cors: &Cors, hostname: &str) -> ServiceResponse<Eithe
 
   test::call_service(&cors, request).await
 }
+
+async fn make_preflight_request(
+  cors: &Cors,
+  hostname: &str,
+  method: &str,
+) -> ServiceResponse<EitherBody<BoxBody>> {
+  let cors = cors.new_transform(test::ok_service())
+      .await
+      .unwrap();
+
+  let request = TestRequest::default()
+      .method(Method::OPTIONS)
+      .insert_header(("Origin", hostname))
+      .insert_header(("Access-Control-Request-Method", method))
+      .to_srv_request();
+
+  test::call_service(&cors, request).await
+}