Add CORS support

2 files changed, 49 insertions, 0 deletions

diff --git a/app.py b/app.py
index 4eb4766..fafeb73 100644
--- a/app.py
+++ b/app.py
@@ -5,6 +5,8 @@ from flask.ext.sqlalchemy import SQLAlchemy
 
 from os import environ
 
+from cors import crossdomain
+
 app = Flask(__name__)
 app.config['SQLALCHEMY_DATABASE_URI'] = environ.get('DATABASE_URL', 'postgres://localhost:5432/traces')
 
@@ -31,6 +33,7 @@ class Trace(db.Model):
 
 
 class Traces(restful.Resource):
+    @crossdomain(origin='*')
     def get(self):
         traces = Trace.query.order_by(Trace.id.desc()).limit(3)
         return [{
@@ -38,6 +41,7 @@ class Traces(restful.Resource):
             'trace': trace.trace
         } for trace in traces]
 
+    @crossdomain(origin='*')
     def post(self):
         args = trace_parser.parse_args()
         trace = Trace(args['page'], args['trace'])
diff --git a/cors.py b/cors.py
new file mode 100644
index 0000000..cc0d89f
--- /dev/null
+++ b/cors.py
@@ -0,0 +1,45 @@
+from datetime import timedelta
+from flask import make_response, request, current_app
+from functools import update_wrapper
+
+
+def crossdomain(origin=None, methods=None, headers=None,
+                max_age=21600, attach_to_all=True,
+                automatic_options=True):
+    if methods is not None:
+        methods = ', '.join(sorted(x.upper() for x in methods))
+    if headers is not None and not isinstance(headers, basestring):
+        headers = ', '.join(x.upper() for x in headers)
+    if not isinstance(origin, basestring):
+        origin = ', '.join(origin)
+    if isinstance(max_age, timedelta):
+        max_age = max_age.total_seconds()
+
+    def get_methods():
+        if methods is not None:
+            return methods
+
+        options_resp = current_app.make_default_options_response()
+        return options_resp.headers['allow']
+
+    def decorator(f):
+        def wrapped_function(*args, **kwargs):
+            if automatic_options and request.method == 'OPTIONS':
+                resp = current_app.make_default_options_response()
+            else:
+                resp = make_response(f(*args, **kwargs))
+            if not attach_to_all and request.method != 'OPTIONS':
+                return resp
+
+            h = resp.headers
+
+            h['Access-Control-Allow-Origin'] = origin
+            h['Access-Control-Allow-Methods'] = get_methods()
+            h['Access-Control-Max-Age'] = str(max_age)
+            if headers is not None:
+                h['Access-Control-Allow-Headers'] = headers
+            return resp
+
+        f.provide_automatic_options = False
+        return update_wrapper(wrapped_function, f)
+    return decorator