Function append_cors_headers

packages/server/src/auth.rs:122–171

(
    config: &Config,
    request_headers: &HeaderMap,
    response_headers: &mut HeaderMap,
)

}

pub fn append_cors_headers(
    config: &Config,
    request_headers: &HeaderMap,
    response_headers: &mut HeaderMap,
) {
    let Some(origin) = request_headers
        .get(header::ORIGIN)
        .and_then(|value| value.to_str().ok())
    else {
        return;
    };

    if !origin_is_cors_allowed(config, origin) {
        return;
    }

    if let Ok(value) = HeaderValue::from_str(origin) {
        response_headers.insert(header::ACCESS_CONTROL_ALLOW_ORIGIN, value);
    }
    response_headers.insert(
        header::ACCESS_CONTROL_ALLOW_METHODS,
        HeaderValue::from_static("GET, POST, OPTIONS"),
    );
    response_headers.insert(
        header::ACCESS_CONTROL_ALLOW_HEADERS,
        HeaderValue::from_static(
            "content-type, authorization, x-simdeck-token, x-simdeck-filename",
        ),
    );
    response_headers.insert(
        header::ACCESS_CONTROL_ALLOW_CREDENTIALS,
        HeaderValue::from_static("true"),
    );
    response_headers.insert(header::VARY, HeaderValue::from_static("Origin"));

    // Chrome's Private Network Access (CORS-RFC1918): a public-internet origin
    // (e.g. https://app.simdeck.sh) calling a loopback/private target must see
    // this header on the preflight when the request advertises support.
    if request_headers
        .get("access-control-request-private-network")
        .and_then(|value| value.to_str().ok())
        .map(|value| value.eq_ignore_ascii_case("true"))
        .unwrap_or(false)
    {
        response_headers.insert(
            HeaderName::from_static("access-control-allow-private-network"),
            HeaderValue::from_static("true"),
        );
    }
}

pub fn append_access_cookie(response_headers: &mut HeaderMap, token: &str) {
    if let Ok(value) = HeaderValue::from_str(&access_cookie_value(token)) {