feat: support api gateway and path based CORS

[thantos]

Advanced and tested CORS support!

Option 1 - Infra Config

Uses API Gateway's CORS configuration and the command worker to handler CORS. APIg adds the CORS headers to any response that matches the configuration (headers, methods, etc) and the $default path returns a 204 response on OPTIONS.

No middleware required, no response headers required, same behavior for ALL paths.

new Service(..., {
        cors: {
          allowHeaders: ["authorization", "content-type"],
          // TODO: Change this for prod!
          allowOrigins: ["*"],
          allowMethods: [CorsHttpMethod.ANY],
        },
})

Option 2 - Custom

Uses a command and the router to handler CORS. Requires the commands to return CORS headers manually or via a middleware. Requires the OPTIONS path(s) to be implemented. Allows for customization and dynamic behavior beyond the API level which API gateway allows for.

// Middleware

export async function cors<In>({
  next,
  context,
}: MiddlewareInput<In>): Promise<MiddlewareOutput<In>> {
  const response = await next(context);
   // change for prod!!
  response.headers.set("Access-Control-Allow-Origin", "*");
  response.headers.set(
    "Access-Control-Allow-Headers",
    "Authorization,Content-Type"
  );
  return response;
}

// options command
// the "*" path is turned into a /{proxy+}
cors.options("*", () => return new HttpResponse(undefined, { status: 204 })); // or 200

// any command or path
cors.command(...)
cors.get(...)

[sam-goodwin]

I don't see the cors middleware in here?

[sam-goodwin]

Should we allow this to be configured per command also?

[thantos]

Maybe later, but API Gateway http doesn't support that. The "custom" approach which doesn't use the infra config would support per operation.

[sam-goodwin]

Is this fragile? What about /abc/*

[thantos]

thats fine, would become /abc/{proxy+}

[sam-goodwin]

Why 204? A comment would help

[thantos]

Added

              // CORS expects a 204 or 200, using 204 to match API Gateway
              // and accurately reflect NO CONTENT