Add CORS headers to the media endpoint

Squashed commit of the following:

commit 0a620148dfad998f7b00804cae1db8208b23cc02
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date:   Fri Mar 2 15:08:36 2018 +0000

    Add tests for the Cors Headers

commit dd8518d279cdf3857597fa7ee6150bf383203fe1
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date:   Fri Mar 2 15:08:20 2018 +0000

    Only add Cors Headers to requests to the media endpoint

commit 6c79ca5632581345ef406f211b1576a4b7f400fe
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date:   Fri Mar 2 15:07:53 2018 +0000

    Add CorsHeaders to middleware array

commit e12d48ca1e837b14b75bbd87d6197d59d60cf32e
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date:   Fri Mar 2 15:06:32 2018 +0000

    We need to send something to the OPTIONS request to the media endpoint

commit f11c638be464373bff09bf015d4a989e48e61f0c
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date:   Fri Mar 2 15:05:45 2018 +0000

    Change routes to allow for responses to an OPTIONS request to the media endpoint

app/Http/Controllers/MicropubController.php

@@ -211,6 +211,16 @@ class MicropubController extends Controller
         ], 201)->header('Location', $media->url);
     }
 
+    /**
+     * Return the relavent CORS headers to a pre-flight OPTIONS request.
+     *
+     * @return \Illuminate\Http\Response
+     */
+    public function mediaOptionsResponse(): Response
+    {
+        return response('OK', 200);
+    }
+
     /**
      * Get the file type from the mimetype of the uploaded file.
      *

app/Http/Kernel.php

@@ -62,5 +62,6 @@ class Kernel extends HttpKernel
         'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
         'micropub.token' => \App\Http\Middleware\VerifyMicropubToken::class,
         'myauth' => \App\Http\Middleware\MyAuthMiddleware::class,
+        'cors' => \App\Http\Middleware\CorsHeaders::class,
     ];
 }

app/Http/Middleware/CorsHeaders.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+
+class CorsHeaders
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @return mixed
+     */
+    public function handle($request, Closure $next)
+    {
+        $response = $next($request);
+        if ($request->path() === 'api/media') {
+            $response->header('Access-Control-Allow-Origin', '*');
+            $response->header('Access-Control-Allow-Methods', 'OPTIONS, POST');
+            $response->header('Access-Control-Allow-Headers', 'Authorization, Content-Type, DNT, X-CSRF-TOKEN, X-REQUESTED-WITH');
+            $response->header('Access-Control-Allow-Credentials', 'true');
+        }
+
+        return $response;
+    }
+}