CBG-2877 allow options to contain db-scoped CORS (#6205)

* CBG-2877 allow options to contain db-scoped CORS

* Use pathVars from router.Match to determine keyspace

---------

Co-authored-by: adamcfraser <[email protected]>

Author: torcolvin

rest/api_test.go

@@ -255,26 +255,50 @@ func TestCORSOrigin(t *testing.T) {
 			reqHeaders := map[string]string{
 				"Origin": tc.origin,
 			}
-			response := rt.SendRequestWithHeaders("GET", "/{{.keyspace}}/", "", reqHeaders)
-			assert.Equal(t, tc.headerOutput, response.Header().Get("Access-Control-Allow-Origin"))
-			RequireStatus(t, response, http.StatusBadRequest)
-			require.Contains(t, response.Body.String(), invalidDatabaseName)
-
-			response = rt.SendRequestWithHeaders("GET", "/{{.db}}/", "", reqHeaders)
-			assert.Equal(t, tc.headerOutput, response.Header().Get("Access-Control-Allow-Origin"))
-			RequireStatus(t, response, http.StatusUnauthorized)
-			require.Contains(t, response.Body.String(), ErrLoginRequired.Message)
-
-			response = rt.SendRequestWithHeaders("GET", "/notadb/", "", reqHeaders)
-			assert.Equal(t, tc.headerOutput, response.Header().Get("Access-Control-Allow-Origin"))
-			RequireStatus(t, response, http.StatusUnauthorized)
-			require.Contains(t, response.Body.String(), ErrLoginRequired.Message)
-
-			// admin port doesn't have CORS
-			response = rt.SendAdminRequestWithHeaders("GET", "/{{.keyspace}}/_all_docs", "", reqHeaders)
-			assert.Equal(t, "", response.Header().Get("Access-Control-Allow-Origin"))
-			RequireStatus(t, response, http.StatusOK)
+			for _, method := range []string{http.MethodGet, http.MethodOptions} {
+				response := rt.SendRequestWithHeaders(method, "/{{.keyspace}}/", "", reqHeaders)
+				assert.Equal(t, tc.headerOutput, response.Header().Get("Access-Control-Allow-Origin"))
+				if method == http.MethodGet {
+					RequireStatus(t, response, http.StatusBadRequest)
+					require.Contains(t, response.Body.String(), invalidDatabaseName)
+				} else {
+					RequireStatus(t, response, http.StatusNoContent)
+
+				}
+			}
+			for _, method := range []string{http.MethodGet, http.MethodOptions} {
+				response := rt.SendRequestWithHeaders(method, "/{{.db}}/", "", reqHeaders)
+				assert.Equal(t, tc.headerOutput, response.Header().Get("Access-Control-Allow-Origin"))
+				if method == http.MethodGet {
+					RequireStatus(t, response, http.StatusUnauthorized)
+					require.Contains(t, response.Body.String(), ErrLoginRequired.Message)
+				} else {
+					RequireStatus(t, response, http.StatusNoContent)
 
+				}
+			}
+			for _, method := range []string{http.MethodGet, http.MethodOptions} {
+				response := rt.SendRequestWithHeaders(method, "/notadb/", "", reqHeaders)
+				assert.Equal(t, tc.headerOutput, response.Header().Get("Access-Control-Allow-Origin"))
+				if method == http.MethodGet {
+					RequireStatus(t, response, http.StatusUnauthorized)
+					require.Contains(t, response.Body.String(), ErrLoginRequired.Message)
+				} else {
+					RequireStatus(t, response, http.StatusNoContent)
+
+				}
+			}
+
+			for _, method := range []string{http.MethodGet, http.MethodOptions} {
+				// admin port doesn't have CORS
+				response := rt.SendAdminRequestWithHeaders(method, "/{{.keyspace}}/_all_docs", "", reqHeaders)
+				assert.Equal(t, "", response.Header().Get("Access-Control-Allow-Origin"))
+				if method == http.MethodGet {
+					RequireStatus(t, response, http.StatusOK)
+				} else {
+					RequireStatus(t, response, http.StatusNoContent)
+				}
+			}
 			// test with a config without * should reject non-matches
 			sc := rt.ServerContext()
 			defer func() {
@@ -283,8 +307,10 @@ func TestCORSOrigin(t *testing.T) {
 
 			sc.Config.API.CORS.Origin = []string{"http://example.com", "http://staging.example.com"}
 			if !base.StringSliceContains(sc.Config.API.CORS.Origin, tc.origin) {
-				response = rt.SendRequestWithHeaders("GET", "/{{.keyspace}}/", "", reqHeaders)
-				assert.Equal(t, "", response.Header().Get("Access-Control-Allow-Origin"))
+				for _, method := range []string{http.MethodGet, http.MethodOptions} {
+					response := rt.SendRequestWithHeaders(method, "/{{.keyspace}}/", "", reqHeaders)
+					assert.Equal(t, "", response.Header().Get("Access-Control-Allow-Origin"))
+				}
 			}
 		})
 	}