41-add-cors-filter-to-enable-cross-origin-requests (#120)

* Add CORS filter to enable cross-origin requests

* Make HttpResponse mutable to support CORS and response-modifying filters

HttpResponse was immutable, which prevented filters from adding headers
or modifying status/body. Since our filter chain relies on mutating the
shared response object, immutability blocked correct CORS implementation.

Added setter methods and removed unmodifiable headers wrapper.
HttpResponseWriter remains unaffected.

* Add unit tests for CORS filter functionality

* Add tests for CORS filter handling of origin headers and preflight requests

* Make HttpResponse mutable and update CORS filter to set status and headers correctly

* Enhance CORS filter to manage 'Vary' header and fix 'Access-Control-Allow-Headers' setting

* Add default constructor to HttpResponse for easier instantiation

* Refactor CORS filter tests to use mock requests and responses

Author: VonAdamo

src/main/java/org/juv25d/filter/CorsFilter.java

@@ -0,0 +1,74 @@
+package org.juv25d.filter;
+
+import org.juv25d.http.HttpRequest;
+import org.juv25d.http.HttpResponse;
+
+import java.io.IOException;
+import java.util.Map;
+import java.util.Set;
+
+public class CorsFilter implements Filter {
+
+    // Whitelist, allow known origins:
+    private static final Set<String> ALLOWED_ORIGINS = Set.of(
+        "http://localhost:3000"
+    );
+
+    // Supported methods
+    private static final String ALLOWED_METHODS = "GET, POST, PUT, PATCH, DELETE, OPTIONS";
+
+    @Override
+    public void doFilter(HttpRequest req, HttpResponse res, FilterChain chain) throws IOException {
+        String origin = header(req.headers(), "Origin");
+
+        // No Origin header || no browser cross-origin req, No CORS headers needed
+        if (origin == null || origin.isBlank()) {
+            chain.doFilter(req, res);
+            return;
+        }
+
+        // Origin exists but are not allowed, return no CORS headers
+        if (!ALLOWED_ORIGINS.contains(origin)) {
+            chain.doFilter(req, res);
+            return;
+        }
+
+        // Allowed origin => AC-AO on all res, even GET
+        res.setHeader("Access-Control-Allow-Origin", origin);
+        String vary = res.getHeader("Vary");
+        if (vary == null || vary.isBlank()) {
+            res.setHeader("Vary", "Origin");
+        } else if (!vary.toLowerCase().contains("origin")) {
+            res.setHeader("Vary", vary + ", Origin");
+        }
+
+        // Preflight, OPTIONS
+        if ("OPTIONS".equalsIgnoreCase(req.method())) {
+            res.setHeader("Access-Control-Allow-Methods", ALLOWED_METHODS);
+
+            // If browser requests specific headers, mirror
+            String requestedHeaders = header(req.headers(), "Access-Control-Request-Headers");
+            if (requestedHeaders != null && !requestedHeaders.isBlank()) {
+                res.setHeader("Access-Control-Allow-Headers", requestedHeaders);
+            } else {
+                res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+            }
+            res.setHeader("Access-Control-Max-Age", "3600");
+            res.setStatusText("No Content");
+            res.setStatusCode(204);
+            res.setBody(new byte[0]);
+            return;
+        }
+        // Regular request (GET/POST)
+        chain.doFilter(req, res);
+    }
+
+    private String header(Map<String, String> headers, String key) {
+        for (var entry : headers.entrySet()) {
+            if (entry.getKey() != null && entry.getKey().equalsIgnoreCase(key)) {
+                return entry.getValue();
+            }
+        }
+        return null;
+    }
+}

src/main/java/org/juv25d/http/HttpResponse.java

@@ -11,7 +11,7 @@ public class HttpResponse {
 
     private int statusCode;
     private String statusText;
-    private final Map<String, String> headers;
+    private Map<String, String> headers;
     private byte[] body;
 
     public HttpResponse() {
@@ -49,6 +49,18 @@ public Map<String, String> headers() {
         return headers;
     }
 
+    public String getHeader(String name) {
+        if (name == null) {
+            return null;
+        }
+        for (var entry : headers.entrySet()) {
+            if (entry.getKey() != null && entry.getKey().equalsIgnoreCase(name)) {
+                return entry.getValue();
+            }
+        }
+        return null;
+    }
+
     public void setHeader(String name, String value) {
         headers.put(name, value);
     }

src/test/java/org/juv25d/filter/CorsFilterTest.java

@@ -0,0 +1,114 @@
+package org.juv25d.filter;
+
+import org.juv25d.http.HttpRequest;
+import org.juv25d.http.HttpResponse;
+import org.junit.jupiter.api.Test;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+public class CorsFilterTest {
+
+    private final CorsFilter filter = new CorsFilter();
+
+    @Test
+    void shouldAllowConfiguredOrigin_onGet() throws Exception {
+        HttpRequest req = request("GET", "/api/test", Map.of("Origin", "http://localhost:3000"));
+        HttpResponse res = response();
+        FilterChain chain = mock(FilterChain.class);
+
+        filter.doFilter(req, res, chain);
+
+        verify(chain).doFilter(req, res);
+        assertEquals("http://localhost:3000", res.getHeader("Access-Control-Allow-Origin"));
+        assertEquals("Origin", res.getHeader("Vary"));
+    }
+
+    @Test
+    void shouldNotAddCorsHeaders_whenNoOriginHeader() throws Exception {
+        HttpRequest req = request("GET", "/api/test", Map.of());
+        HttpResponse res = response();
+        FilterChain chain = mock(FilterChain.class);
+
+        filter.doFilter(req, res, chain);
+
+        verify(chain).doFilter(req, res);
+        assertNull(res.getHeader("Access-Control-Allow-Origin"));
+    }
+
+    @Test
+    void shouldHandlePreflightOptionsRequest() throws Exception {
+        HttpRequest req = request(
+            "OPTIONS",
+            "/api/test",
+            Map.of(
+                "Origin", "http://localhost:3000",
+                "Access-Control-Request-Method", "GET",
+                "Access-Control-Request-Headers", "Content-Type"
+            )
+        );
+        HttpResponse res = response();
+        FilterChain chain = mock(FilterChain.class);
+
+        filter.doFilter(req, res, chain);
+
+        verify(chain, never()).doFilter(any(), any());
+        assertEquals(204, res.statusCode());
+        assertEquals("No Content", res.statusText());
+        assertEquals("http://localhost:3000", res.getHeader("Access-Control-Allow-Origin"));
+        assertTrue(res.getHeader("Access-Control-Allow-Methods").contains("GET"));
+        assertEquals("Content-Type", res.getHeader("Access-Control-Allow-Headers"));
+        assertArrayEquals(new byte[0], res.body());
+    }
+
+    @Test
+    void shouldNotAllowUnknownOrigin() throws Exception {
+        HttpRequest req = request("GET", "/api/test", Map.of("Origin", "http://evil.com"));
+        HttpResponse res = response();
+        FilterChain chain = mock(FilterChain.class);
+
+        filter.doFilter(req, res, chain);
+
+        verify(chain).doFilter(req, res);
+        assertNull(res.getHeader("Access-Control-Allow-Origin"));
+    }
+
+    @Test
+    void shouldFallbackToDefaultAllowHeaders_onPreflightWithoutRequestHeaders() throws Exception {
+        HttpRequest req = request(
+            "OPTIONS",
+            "/api/test",
+            Map.of(
+                "Origin", "http://localhost:3000",
+                "Access-Control-Request-Method", "GET"
+            )
+        );
+        HttpResponse res = response();
+        FilterChain chain = mock(FilterChain.class);
+
+        filter.doFilter(req, res, chain);
+
+        verify(chain, never()).doFilter(any(), any());
+        assertEquals(204, res.statusCode());
+        assertEquals("Content-Type", res.getHeader("Access-Control-Allow-Headers"));
+    }
+
+    private static HttpRequest request(String method, String path, Map<String, String> headers) {
+        return new HttpRequest(
+            method,
+            path,
+            "",
+            "HTTP/1.1",
+            new HashMap<>(headers),
+            new byte[0],
+            "127.0.0.1"
+        );
+    }
+
+    private static HttpResponse response() {
+        return new HttpResponse(200, "OK", new HashMap<>(), new byte[0]);
+    }
+}