Allow origin frontend

Author: tatevikg1

composer.json

@@ -50,7 +50,8 @@
         "ext-dom": "*",
         "tatevikgr/rss-feed": "dev-main as 0.1.0",
         "psr/simple-cache": "^3.0",
-        "symfony/expression-language": "^6.4"
+        "symfony/expression-language": "^6.4",
+        "nelmio/cors-bundle": "^2.4"
     },
     "require-dev": {
         "phpunit/phpunit": "^10.0",

src/DependencyInjection/PhpListRestExtension.php

@@ -8,6 +8,7 @@
 use InvalidArgumentException;
 use Symfony\Component\Config\FileLocator;
 use Symfony\Component\DependencyInjection\ContainerBuilder;
+use Symfony\Component\DependencyInjection\Extension\PrependExtensionInterface;
 use Symfony\Component\DependencyInjection\Loader\YamlFileLoader;
 use Symfony\Component\HttpKernel\DependencyInjection\Extension;
 
@@ -16,7 +17,7 @@
  *
  * @author Oliver Klee <oliver@phplist.com>
  */
-class PhpListRestExtension extends Extension
+class PhpListRestExtension extends Extension implements PrependExtensionInterface
 {
     /**
      * Loads a specific configuration.
@@ -35,4 +36,34 @@ public function load(array $configs, ContainerBuilder $container): void
         $loader = new YamlFileLoader($container, new FileLocator(__DIR__ . '/../../config'));
         $loader->load('services.yml');
     }
+
+    /**
+     * @param ContainerBuilder $container
+     *
+     * @return void
+     */
+    public function prepend(ContainerBuilder $container): void
+    {
+        $frontendBaseUrl = $container->getParameter('app.frontend_base_url');
+
+        $container->prependExtensionConfig('nelmio_cors', [
+            'defaults' => [
+                'allow_origin' => [$frontendBaseUrl],
+                'allow_methods' => ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
+                'allow_headers' => ['Content-Type', 'Authorization', 'Origin', 'Accept', 'php-auth-pw'],
+                'expose_headers' => ['X-Content-Type-Options', 'Content-Security-Policy', 'X-Frame-Options'],
+                'max_age' => 3600,
+            ],
+            'paths' => [
+                '^/api/v2' => [
+                    'origin_regex' => true,
+                    'allow_origin' => [$frontendBaseUrl],
+                    'allow_methods' => ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
+                    'allow_headers' => ['Content-Type', 'Authorization', 'Origin', 'Accept', 'php-auth-pw'],
+                    'expose_headers' => ['X-Content-Type-Options', 'Content-Security-Policy', 'X-Frame-Options'],
+                    'max_age' => 3600,
+                ],
+            ],
+        ]);
+    }
 }