feat: CORS for the REST and S3 interfaces

Author: St4NNi

.env.example

@@ -16,5 +16,14 @@ METADATA_REPLICATION_FACTOR=3
 S3_HOST=127.0.0.1:1337
 S3_ADDRESS=0.0.0.0:1337
 
+# Comma-separated list of origins allowed to call the REST and S3 interfaces
+# from a browser (e.g. http://localhost:5173 for the portal dev server).
+# Empty = deny all cross-origin requests. A literal * allows every origin.
+CORS_ALLOWED_ORIGINS=
+
+# Maximum REST request body size in bytes (default 1 MiB). Oversized bodies
+# are rejected with 413.
+MAX_HTTP_BODY_SIZE=
+
 RUST_LOG=
 OTEL_EXPORTER_OTLP_ENDPOINT=

Cargo.lock

@@ -122,6 +122,7 @@ tempfile = "3.27.0"
 thiserror = "2.0.18"
 tokio = { version = "1.52.3", features = ["full", "tracing"] }
 tokio-util = "0.7.18"
+tower-http = { version = "0.6.7", features = ["cors"] }
 tracing = "0.1.44"
 tracing-opentelemetry = { version = "0.33.0", default-features = false }
 tracing-subscriber = { version = "0.3.23", features = [

Cargo.toml

@@ -46,6 +46,7 @@ async-trait = { workspace = true }
 futures-core = { workspace = true }
 futures-util = { workspace = true }
 http = { workspace = true }
+tower-http = { workspace = true }
 hyper = { workspace = true }
 hyper-util = { workspace = true }
 s3s = { workspace = true }

api/Cargo.toml

@@ -0,0 +1,237 @@
+use axum::http::Method;
+use http::HeaderMap;
+use http::HeaderValue;
+use http::header;
+use std::time::Duration;
+use tower_http::cors::{AllowOrigin, CorsLayer};
+
+const CORS_MAX_AGE: Duration = Duration::from_secs(3600);
+const S3_ALLOWED_METHODS: &str = "GET,HEAD,PUT,POST,DELETE,OPTIONS";
+const S3_DEFAULT_ALLOWED_HEADERS: &str = "authorization,content-type,content-md5,range,\
+     x-amz-content-sha256,x-amz-date,x-amz-security-token,x-amz-user-agent";
+const S3_EXPOSED_HEADERS: &str = "etag,content-range,accept-ranges,content-length,last-modified,\
+     x-amz-request-id,x-amz-version-id,x-amz-delete-marker,aruna-source-content-type,\
+     aruna-source-etag,aruna-source-last-modified,aruna-last-refresh";
+
+/// Allowed cross-origin request origins, shared by the REST and S3 interfaces.
+/// An empty configuration denies all cross-origin access (no CORS headers are
+/// emitted); a literal `*` entry allows every origin.
+#[derive(Clone, Debug, Default)]
+pub struct CorsConfig {
+    allowed_origins: Vec<String>,
+    allow_any: bool,
+}
+
+impl CorsConfig {
+    pub fn new(origins: impl IntoIterator<Item = String>) -> Self {
+        let mut allowed_origins = Vec::new();
+        let mut allow_any = false;
+        for origin in origins {
+            let origin = origin.trim().trim_end_matches('/');
+            if origin.is_empty() {
+                continue;
+            }
+            if origin == "*" {
+                allow_any = true;
+            } else {
+                allowed_origins.push(origin.to_string());
+            }
+        }
+        Self {
+            allowed_origins,
+            allow_any,
+        }
+    }
+
+    pub fn is_enabled(&self) -> bool {
+        self.allow_any || !self.allowed_origins.is_empty()
+    }
+
+    pub fn allows(&self, origin: &HeaderValue) -> bool {
+        if self.allow_any {
+            return true;
+        }
+        origin
+            .to_str()
+            .map(|origin| {
+                self.allowed_origins
+                    .iter()
+                    .any(|allowed| allowed == origin.trim_end_matches('/'))
+            })
+            .unwrap_or(false)
+    }
+
+    pub fn rest_layer(&self) -> Option<CorsLayer> {
+        if !self.is_enabled() {
+            return None;
+        }
+        let allow_origin = if self.allow_any {
+            AllowOrigin::any()
+        } else {
+            AllowOrigin::list(
+                self.allowed_origins
+                    .iter()
+                    .filter_map(|origin| origin.parse().ok()),
+            )
+        };
+        Some(
+            CorsLayer::new()
+                .allow_origin(allow_origin)
+                .allow_methods([
+                    Method::GET,
+                    Method::POST,
+                    Method::PUT,
+                    Method::PATCH,
+                    Method::DELETE,
+                    Method::HEAD,
+                    Method::OPTIONS,
+                ])
+                .allow_headers([header::AUTHORIZATION, header::CONTENT_TYPE])
+                .max_age(CORS_MAX_AGE),
+        )
+    }
+
+    fn allow_origin_value(&self, origin: &HeaderValue) -> HeaderValue {
+        if self.allow_any {
+            HeaderValue::from_static("*")
+        } else {
+            origin.clone()
+        }
+    }
+
+    /// Headers for an S3 preflight response. Returns `None` when the origin is
+    /// not allowed; the preflight is then answered without CORS headers.
+    pub fn s3_preflight_headers(
+        &self,
+        origin: &HeaderValue,
+        requested_headers: Option<&HeaderValue>,
+    ) -> Option<HeaderMap> {
+        if !self.allows(origin) {
+            return None;
+        }
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::ACCESS_CONTROL_ALLOW_ORIGIN,
+            self.allow_origin_value(origin),
+        );
+        headers.insert(
+            header::ACCESS_CONTROL_ALLOW_METHODS,
+            HeaderValue::from_static(S3_ALLOWED_METHODS),
+        );
+        headers.insert(
+            header::ACCESS_CONTROL_ALLOW_HEADERS,
+            requested_headers
+                .cloned()
+                .unwrap_or_else(|| HeaderValue::from_static(S3_DEFAULT_ALLOWED_HEADERS)),
+        );
+        headers.insert(
+            header::ACCESS_CONTROL_MAX_AGE,
+            HeaderValue::from(CORS_MAX_AGE.as_secs()),
+        );
+        headers.insert(header::VARY, HeaderValue::from_static("origin"));
+        Some(headers)
+    }
+
+    /// Adds CORS headers to a normal (non-preflight) S3 response when the
+    /// request origin is allowed.
+    pub fn apply_s3_response_headers(&self, origin: Option<&HeaderValue>, headers: &mut HeaderMap) {
+        let Some(origin) = origin else {
+            return;
+        };
+        if !self.allows(origin) {
+            return;
+        }
+        headers.insert(
+            header::ACCESS_CONTROL_ALLOW_ORIGIN,
+            self.allow_origin_value(origin),
+        );
+        headers.insert(
+            header::ACCESS_CONTROL_EXPOSE_HEADERS,
+            HeaderValue::from_static(S3_EXPOSED_HEADERS),
+        );
+        headers.append(header::VARY, HeaderValue::from_static("origin"));
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn empty_config_denies_everything() {
+        let config = CorsConfig::default();
+        assert!(!config.is_enabled());
+        assert!(!config.allows(&HeaderValue::from_static("http://portal.test")));
+        assert!(config.rest_layer().is_none());
+        assert!(
+            config
+                .s3_preflight_headers(&HeaderValue::from_static("http://portal.test"), None)
+                .is_none()
+        );
+        let mut headers = HeaderMap::new();
+        config.apply_s3_response_headers(
+            Some(&HeaderValue::from_static("http://portal.test")),
+            &mut headers,
+        );
+        assert!(headers.is_empty());
+    }
+
+    #[test]
+    fn listed_origin_is_allowed_and_reflected() {
+        let config = CorsConfig::new(vec!["http://portal.test".to_string()]);
+        let origin = HeaderValue::from_static("http://portal.test");
+        assert!(config.allows(&origin));
+        assert!(!config.allows(&HeaderValue::from_static("http://evil.test")));
+
+        let headers = config.s3_preflight_headers(&origin, None).unwrap();
+        assert_eq!(
+            headers.get(header::ACCESS_CONTROL_ALLOW_ORIGIN).unwrap(),
+            &origin
+        );
+
+        let mut response_headers = HeaderMap::new();
+        config.apply_s3_response_headers(Some(&origin), &mut response_headers);
+        assert_eq!(
+            response_headers
+                .get(header::ACCESS_CONTROL_ALLOW_ORIGIN)
+                .unwrap(),
+            &origin
+        );
+        assert!(
+            response_headers
+                .get(header::ACCESS_CONTROL_EXPOSE_HEADERS)
+                .unwrap()
+                .to_str()
+                .unwrap()
+                .contains("etag")
+        );
+    }
+
+    #[test]
+    fn wildcard_allows_any_origin() {
+        let config = CorsConfig::new(vec!["*".to_string()]);
+        let origin = HeaderValue::from_static("http://anywhere.test");
+        assert!(config.allows(&origin));
+        let headers = config.s3_preflight_headers(&origin, None).unwrap();
+        assert_eq!(
+            headers.get(header::ACCESS_CONTROL_ALLOW_ORIGIN).unwrap(),
+            "*"
+        );
+    }
+
+    #[test]
+    fn preflight_echoes_requested_headers() {
+        let config = CorsConfig::new(vec!["http://portal.test".to_string()]);
+        let requested = HeaderValue::from_static("authorization,x-amz-meta-custom");
+        let headers = config
+            .s3_preflight_headers(
+                &HeaderValue::from_static("http://portal.test"),
+                Some(&requested),
+            )
+            .unwrap();
+        assert_eq!(
+            headers.get(header::ACCESS_CONTROL_ALLOW_HEADERS).unwrap(),
+            &requested
+        );
+    }
+}

api/src/cors.rs

@@ -1,6 +1,7 @@
 #![allow(clippy::result_large_err)]
 
 pub mod auth;
+pub mod cors;
 pub mod error;
 pub mod openapi;
 pub mod routes;

api/src/lib.rs

@@ -1162,6 +1162,7 @@ mod tests {
             ServerConfig {
                 http_addr: addr,
                 max_http_body_size: crate::server::DEFAULT_MAX_HTTP_BODY_SIZE,
+                cors: crate::cors::CorsConfig::default(),
             },
         )
         .build_router();

api/src/routes/users.rs

@@ -1,12 +1,13 @@
 use super::auth::AuthProvider;
 use super::s3_service::ArunaS3Service;
+use crate::cors::CorsConfig;
 use crate::error::S3ServerError;
 use crate::telemetry::{emit_request_completed, make_request_span};
 use aruna_core::NodeId;
 use aruna_core::structs::RealmId;
 use aruna_operations::driver::DriverContext;
 use futures_core::future::BoxFuture;
-use http::Request;
+use http::{Method, Request, StatusCode, header};
 use hyper::body::Incoming;
 use hyper::service::Service;
 use hyper_util::rt::TokioExecutor;
@@ -28,11 +29,13 @@ use tracing::{Instrument, error, info, trace};
 pub struct S3Server {
     address: String,
     s3service: S3Service,
+    cors: CorsConfig,
 }
 
 #[derive(Clone)]
 pub struct WrappingService {
     shared: S3Service, // Aruna specific implementation of S3 trait
+    cors: CorsConfig,
 }
 
 impl S3Server {
@@ -43,6 +46,7 @@ impl S3Server {
         driver_ctx: Arc<DriverContext>,
         realm_id: RealmId,
         node_id: NodeId,
+        cors: CorsConfig,
     ) -> Result<Self, S3ServerError> {
         let s3service = ArunaS3Service::new(driver_ctx.clone(), realm_id, node_id).await;
 
@@ -64,6 +68,7 @@ impl S3Server {
         Ok(Self {
             address: address.into(),
             s3service: service,
+            cors,
         })
     }
 
@@ -74,6 +79,7 @@ impl S3Server {
         let local_addr = listener.local_addr()?;
         let service = WrappingService {
             shared: self.s3service,
+            cors: self.cors,
         };
         let connection = ConnBuilder::new(TokioExecutor::new());
 
@@ -116,7 +122,29 @@ impl Service<Request<Incoming>> for WrappingService {
     type Future = BoxFuture<'static, Result<Self::Response, Self::Error>>;
 
     fn call(&self, req: Request<Incoming>) -> Self::Future {
-        //TODO: CORS
+        let origin = req.headers().get(header::ORIGIN).cloned();
+
+        // Answer CORS preflight before s3s signature validation: an unsigned
+        // OPTIONS request must not fail with 403.
+        if req.method() == Method::OPTIONS
+            && let Some(origin) = origin.as_ref()
+        {
+            let requested_headers = req
+                .headers()
+                .get(header::ACCESS_CONTROL_REQUEST_HEADERS)
+                .cloned();
+            let mut response = http::Response::builder()
+                .status(StatusCode::NO_CONTENT)
+                .body(s3s::Body::empty())
+                .expect("static response must build");
+            if let Some(cors_headers) = self
+                .cors
+                .s3_preflight_headers(origin, requested_headers.as_ref())
+            {
+                response.headers_mut().extend(cors_headers);
+            }
+            return Box::pin(async move { Ok(response) });
+        }
 
         // Default S3 operation call
         let (parts, body) = req.into_parts();
@@ -136,8 +164,12 @@ impl Service<Request<Incoming>> for WrappingService {
         }
         let s3s_request = s3s::HttpRequest::from_parts(parts, body.into());
         let shared = self.shared.clone();
+        let cors = self.cors.clone();
         Box::pin(async move {
-            let result = shared.call(s3s_request).instrument(span.clone()).await;
+            let mut result = shared.call(s3s_request).instrument(span.clone()).await;
+            if let Ok(response) = &mut result {
+                cors.apply_s3_response_headers(origin.as_ref(), response.headers_mut());
+            }
             match &result {
                 Ok(response) => {
                     emit_request_completed(&span, "s3", response.status().as_u16(), started)