feat(site-publish): reconcile split-surface CORS

Authored-By: @architect <architect@fritzlab.net>

scripts/utils.py

@@ -1,5 +1,6 @@
 """Shared utilities for the site-publish action."""
 
+import ipaddress
 import os
 import re
 import shutil
@@ -104,6 +105,51 @@ def _strings(value, label):
     return values
 
 
+def _cors_origins(value, label):
+    origins = _list(value, label)
+    if any(not isinstance(item, str) or not item for item in origins):
+        raise ConfigError(f"{label} must be a list of non-empty strings")
+    canonical = []
+    for origin in origins:
+        if origin == "*":
+            canonical.append(origin)
+            continue
+        parsed = urlparse(origin)
+        try:
+            port = parsed.port
+        except ValueError:
+            raise ConfigError(f"{label} must contain '*' or canonical HTTPS origins") from None
+        if parsed.scheme != "https" or not parsed.hostname or parsed.path or parsed.params or (
+            parsed.query or parsed.fragment or parsed.username or parsed.password
+        ):
+            raise ConfigError(f"{label} must contain '*' or canonical HTTPS origins")
+        try:
+            address = ipaddress.ip_address(parsed.hostname)
+        except ValueError:
+            try:
+                hostname = parsed.hostname.encode("idna").decode("ascii")
+            except UnicodeError:
+                raise ConfigError(
+                    f"{label} must contain '*' or canonical HTTPS origins"
+                ) from None
+            try:
+                _hostname(hostname, f"{label} hostname")
+            except ConfigError:
+                raise ConfigError(
+                    f"{label} must contain '*' or canonical HTTPS origins"
+                ) from None
+        else:
+            hostname = f"[{address.compressed}]" if address.version == 6 else address.compressed
+        canonical.append(f"https://{hostname}{f':{port}' if port not in (None, 443) else ''}")
+    if len(canonical) != len(set(canonical)):
+        raise ConfigError(f"{label} must not contain duplicate canonical origins")
+    if "*" in canonical and len(canonical) != 1:
+        raise ConfigError(f"{label} wildcard must be the only origin")
+    if origins != canonical:
+        raise ConfigError(f"{label} must contain '*' or canonical HTTPS origins")
+    return origins
+
+
 def _hostname(value, label):
     if not isinstance(value, str) or len(value) > 253 or value.endswith("."):
         raise ConfigError(f"{label} must be a lowercase DNS hostname without a trailing dot")
@@ -215,6 +261,7 @@ def _legacy_config(raw, site_name):
         "website_authority": "garage-s3.storage.svc.k8s.sjc001.fritzlab.net",
         "credentials": {"access_key_env": "AWS_ACCESS_KEY_ID", "secret_key_env": "AWS_SECRET_ACCESS_KEY"},
         "cache_rules": [{"path": "", "cache_control": DEFAULT_CACHE_CONTROL}],
+        "cors_origins": None,
     }
     return {
         "version": 1,
@@ -234,7 +281,11 @@ def _legacy_config(raw, site_name):
 def _artifact(item, index):
     label = f"artifacts[{index}]"
     item = _mapping(item, label)
-    _known_keys(item, {"name", "type", "content_dir", "tidy", "excludes", "publish", "cache"}, label)
+    _known_keys(
+        item,
+        {"name", "type", "content_dir", "tidy", "excludes", "publish", "cache", "cors_origins"},
+        label,
+    )
     name = item.get("name")
     if not isinstance(name, str) or not NAME_RE.fullmatch(name):
         raise ConfigError(f"{label}.name must be a DNS label")
@@ -303,6 +354,10 @@ def _artifact(item, index):
         "website_authority": authority,
         "credentials": normalized_credentials,
         "cache_rules": cache_rules,
+        "cors_origins": (
+            _cors_origins(item["cors_origins"], f"{label}.cors_origins")
+            if "cors_origins" in item else []
+        ),
     }
 
 
@@ -389,6 +444,10 @@ def _validate_multi(cfg):
                 raise ConfigError(f"protected route {route['name']} cannot use shared-cache max-age")
             if route["access"] == "public" and "private" in directives:
                 raise ConfigError(f"public route {route['name']} cannot use private cache policy")
+        if route["access"] == "protected" and "*" in artifact["cors_origins"]:
+            raise ConfigError(
+                f"protected route {route['name']} cannot allow wildcard CORS"
+            )
     root = next(route for route in routes if route["path"] == "/")
     if any(route["access"] == "protected" for route in routes) and root["access"] == "public":
         raise ConfigError("a public '/' catch-all would expose unmatched protected content")