Chore #49 (PR #50)

Author: challet

packages/nextjs/next.config.js

@@ -16,8 +16,25 @@ const nextConfig = {
     config.externals.push("pino-pretty", "lokijs", "encoding");
     return config;
   },
+  async headers() {
+    if ('CSP_FRAMES' in process.env) {
+      return [
+        {
+          source: '/:path*',
+          headers: [
+            {
+              key: "Content-Security-Policy",
+              value: `frame-ancestors ${process.env.CSP_FRAMES}`
+            }
+          ]
+        }
+      ]
+    } else {
+      return [];
+    }
+  },
   // the following doesn't seem to work, see instead package.json "build" script containing "tsc --build" and tsconfig.json "refereences" setting
-  transpilePackages: ['@10tance/map'],
+  transpilePackages: ['@10tance/map']
 };
 
 module.exports = nextConfig;

packages/tileserver/src/index.ts

@@ -1,13 +1,18 @@
 import 'dotenv/config';
-import express, { Express, Request } from "express";
+import express, { Express } from "express";
 import cors from "cors";
 
 import {tilesRoute, objectsRoute, tileBasedMiddlewareFactory} from './routes';
 
 const app: Express = express();
 const port = process.env.PORT || 3001;
 
-app.use(cors());
+const ALLOWED_ORIGIN = (process.env.CORS_ORIGIN) ? new RegExp(process.env.CORS_ORIGIN) : false;
+
+app.use(cors({
+  origin: ALLOWED_ORIGIN,
+  methods: "GET,HEAD,OPTIONS"
+}));
 
 const promise_app = tileBasedMiddlewareFactory()
   .then((tileBasedMiddleware) => {
@@ -24,5 +29,4 @@ process.on("exit", () => {
   // TODO close db;
 })
 
-
-module.exports = promise_app;
+module.exports = promise_app;

packages/tileserver/vercel.json

@@ -4,6 +4,18 @@
     { "src": "src/index.ts", "use": "@vercel/node" }
   ],
   "routes": [
-    { "src": "/(.*)", "dest": "src/index.ts" }
+    { 
+      "src": "/(.*)",
+      "dest": "src/index.ts",
+      "methods": ["GET", "OPTIONS", "HEAD"],
+      "headers": {
+        "Access-Control-Allow-Credentials": "true",
+        "Access-Control-Allow-Methods": "GET,OPTIONS,HEAD",
+        "Access-Control-Allow-Headers": "X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version, Origin",
+        "Cache-Control": "public, max-age=3600, s-maxage=86400, immutable",
+        "CDN-Cache-Control": "public, s-maxage=86400",
+        "Vercel-CDN-Cache-Control": "public, s-maxage=86400"
+      }
+    }
   ]
 }