CORS helpers

[jyecusch]

While CORS can currently be handled using middleware and by registering OPTIONS routes, we'd like to build this support into the framework to make it more convinient and ideally handle the responses as high up the infra stack as possible. For example, providing support for static responses to OPTIONS requests at the API Gateway or Nitric Server layers to reduce latency and hosting costs.

This support will be needed in all language SDKs.

[davemooreuws]

Research of cloud provider API gateway pulumi configs:

AWS:
Seems pretty easy, just put them in apigatewayv2.NewApi

• allowCredentials
• allowHeaders
• allowMethods
• allowOrigins
• exposeHeaders
• maxAge

Azure:
Need to create a cors policy use apimanagement.NewApiOperationPolicy

• allowCredentials
• allowHeaders
• allowMethods
• allowOrigins
• exposeHeaders
• maxAge

GCP:
The worst of the bunch it seems, they suggest using ESP or doing it per function.
References:
https://stackoverflow.com/questions/64281334/cors-errors-when-trying-to-fetch-from-new-google-cloud-api-gateway/65738206#65738206
https://www.googlecloudcommunity.com/gc/Serverless/CORS-issue-with-API-gateway/m-p/619097

TLDR

AWS and Azure seem fine, however considering GCPs lack of support (and lack of a roadmap) Like we have suggested, we could use a load balancer or just handle it on our side, but then if we do this should we just do it consistently across any new provider or pick best prac per cloud?

[davemooreuws]

Reviving this feature for v1. Cleaned up this issue, research was done last year as seen above.

Example in ts:

// no cors by default
const helloApi = api("main");

// with custom settings
const helloApi = api("main", {
  cors: {
    allowOrigins: ["https://cors-test.codehappy.dev"],
    allowCredentials: true,
    allowMethods: ["GET"],
    allowHeaders: ["*"],
    maxAge: "3 days",
  },
});

// with default cors settings
const helloApi = api("public", {
  cors: true,
});

Implementations:

• AWS: via native apigateway
• Azure: via native apimanagement
• GCP: custom implementation in the nitric layer
• Local: custom implementation in the CLI

Old pre v1 reference work to use:

• Feat/cors #539
• feat: cors support cli#595
• feat: add cors support for api resource node-sdk#206