Answer CORS preflight OPTIONS on the enquiry endpoint

.github/workflows/main.yml

@@ -35,9 +35,9 @@ jobs:
     - uses: actions/checkout@v2
 
     - name: set up python
-      uses: actions/setup-python@v1
+      uses: actions/setup-python@v5
       with:
-        python-version: '3.9.21'
+        python-version: '3.9'
 
     - name: install dependencies
       run: |

tcsocket/app/middleware.py

@@ -4,7 +4,7 @@
 from asyncio import CancelledError
 from time import time
 
-from aiohttp.hdrs import METH_GET, METH_HEAD
+from aiohttp.hdrs import METH_GET, METH_HEAD, METH_OPTIONS
 from aiohttp.web_exceptions import HTTPBadRequest, HTTPException, HTTPInternalServerError, HTTPMovedPermanently
 from aiohttp.web_middlewares import middleware
 from aiohttp.web_urldispatcher import SystemRoute
@@ -174,7 +174,7 @@ async def company_middleware(request, handler):
 
 @middleware
 async def json_request_middleware(request, handler):
-    if request.method not in {METH_GET, METH_HEAD} and request.match_info.route.name:
+    if request.method not in {METH_GET, METH_HEAD, METH_OPTIONS} and request.match_info.route.name:
         error_details = None
         try:
             data = await request.json()

tcsocket/app/utils.py

@@ -46,6 +46,12 @@ def pretty_lenient_json(data):
 
 JSON_CONTENT_TYPE = 'application/json'
 ACCESS_CONTROL_HEADERS = {'Access-Control-Allow-Origin': '*'}
+CORS_PREFLIGHT_HEADERS = {
+    **ACCESS_CONTROL_HEADERS,
+    'Access-Control-Allow-Methods': 'POST',
+    'Access-Control-Allow-Headers': 'Content-Type',
+    'Access-Control-Max-Age': '86400',
+}
 
 
 class HTTPClientErrorJson(web.HTTPClientError):

tcsocket/app/views/enquiry.py

@@ -5,11 +5,12 @@
 from operator import itemgetter
 
 import pydantic
-from aiohttp.hdrs import METH_POST
+from aiohttp.hdrs import METH_OPTIONS, METH_POST
+from aiohttp.web_response import Response
 from arq.utils import timestamp_ms
 
 from ..geo import get_ip
-from ..utils import HTTPBadRequestJson, json_response
+from ..utils import CORS_PREFLIGHT_HEADERS, HTTPBadRequestJson, json_response
 from ..worker import REDIS_ENQUIRY_CACHE_KEY, get_enquiry_options, store_enquiry_data
 
 logger = logging.getLogger('socket')
@@ -23,6 +24,10 @@ async def clear_enquiry(request):
 
 
 async def enquiry(request):
+    if request.method == METH_OPTIONS:
+        # CORS preflight sent by browsers before a cross-origin JSON post
+        return Response(status=204, headers=CORS_PREFLIGHT_HEADERS)
+
     company = dict(request['company'])
 
     redis = request.app['redis']

tests/test_enquiries.py

@@ -97,7 +97,6 @@ async def test_post_enquiry_success(cli, company, other_server, worker):
 
 
 async def test_post_enquiry_long_grecaptcha_response(cli, company, other_server, worker):
-    other_server.app['extra_attributes'] = 'default'
     data = {
         'client_name': 'Cat Flap',
         'grecaptcha_response': 'good' * 1000,
@@ -386,3 +385,18 @@ async def test_post_all_optional(cli, company, other_server):
     assert r.status == 201, await r.text()
     data = await r.json()
     assert data == {'status': 'enquiry submitted to TutorCruncher'}
+
+
+async def test_options_enquiry_preflight(cli, company):
+    r = await cli.options(
+        cli.server.app.router['enquiry'].url_for(company=company.public_key),
+        headers={
+            'Origin': 'https://tutorcruncher.com',
+            'Access-Control-Request-Method': 'POST',
+            'Access-Control-Request-Headers': 'content-type',
+        },
+    )
+    assert r.status == 204, await r.text()
+    assert r.headers['Access-Control-Allow-Origin'] == '*'
+    assert r.headers['Access-Control-Allow-Methods'] == 'POST'
+    assert r.headers['Access-Control-Allow-Headers'] == 'Content-Type'