feat: add cors headers if allowed origin is defined (#17)

lib/kirei/config.rb

@@ -37,5 +37,7 @@ class Config < T::Struct
     #
     # Source: https://sorbet.org/docs/tstruct#from_hash-gotchas
     prop :db_strict_type_resolving, T.nilable(T::Boolean), default: nil
+
+    prop :allowed_origins, T::Array[String], default: []
   end
 end

lib/kirei/model/class_methods.rb

@@ -113,7 +113,6 @@ def vector_column?(column_name)
         col_info.fetch(:db_type).match?(/vector\(\d+\)/)
       end
 
-      # New method to cast an array to a vector
       sig { params(value: T.any(T::Array[Numeric], Sequel::SQL::Expression)).returns(Sequel::SQL::Expression) }
       def cast_to_vector(value)
         return value if value.is_a?(Sequel::SQL::Expression) || value.is_a?(Sequel::SQL::PlaceholderLiteralString)

lib/kirei/routing/base.rb

@@ -98,6 +98,8 @@ def call(env)
           headers[header_name] ||= default_value
         end
 
+        add_cors_headers(headers, env)
+
         [
           status,
           headers,
@@ -143,7 +145,6 @@ def render(body, status: 200, headers: {})
 
       sig { returns(T::Hash[String, String]) }
       def default_headers
-        # "Access-Control-Allow-Origin": the user should set that, see comment about "cors" above
         {
           # security relevant headers
           "X-Frame-Options" => "DENY",
@@ -159,6 +160,18 @@ def default_headers
         }
       end
 
+      sig { params(headers: T::Hash[String, String], env: RackEnvType).void }
+      def add_cors_headers(headers, env)
+        origin = T.cast(env.fetch("HTTP_ORIGIN"), String)
+        allowed_origins = Kirei::App.config.allowed_origins
+        return unless allowed_origins.include?(origin)
+
+        headers["Access-Control-Allow-Origin"] = origin
+        headers["Access-Control-Allow-Methods"] = "GET, POST, PUT, PATCH, DELETE, OPTIONS"
+        headers["Access-Control-Allow-Headers"] = "Content-Type, Authorization, Referer"
+        headers["Access-Control-Allow-Credentials"] = "true"
+      end
+
       sig { params(hooks: NilableHooksType).void }
       private def run_hooks(hooks)
         return if hooks.nil? || hooks.empty?