copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Extend CORS headers to include X-Customer-Number and add customer context in subuser grants.

Browse Source
This commit is contained in:
Jeppe Bundgaard
2026-02-12 18:12:29 +01:00
parent 05a4943162
commit aae244887f
5 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nginx.conf
+2 -2
View File
@@ -52,14 +52,14 @@ http {
location / {
add_header Access-Control-Allow-Origin *;
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With";
add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number";
add_header Access-Control-Allow-Credentials true;
# If OPTIONS method is needed for preflight
if ($request_method = 'OPTIONS') {
add_header Access-Control-Allow-Origin *;
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With";
add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number";
return 204; # No Content
}
services/nginx/app/index.php
+1 -1
View File
@@ -17,7 +17,7 @@ if ($DEBUG) {
/** CORS */
header("Access-Control-Allow-Origin: $CORS");
header("Access-Control-Allow-Headers: Content-Type, Authorization");
header("Access-Control-Allow-Headers: Content-Type, Authorization, X-Customer-Number");
header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");
/** Autoload */
services/nginx/app/modules/washcertificates/index.php
+1 -1
View File
@@ -27,7 +27,7 @@ require_once 'twc_spreadsheet_class.php';
// Set CORS headers
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: GET, POST");
header("Access-Control-Allow-Headers: Content-Type");
header("Access-Control-Allow-Headers: Content-Type, X-Customer-Number");
// Set the timezone
date_default_timezone_set('Europe/Copenhagen');
services/nginx/app/routes/subusersRoute.php
+1
View File
@@ -577,6 +577,7 @@ class subusersRoute
"phone" => $subuser->phone->value() !== null ? (int)$subuser->phone->value() : null,
"grants" => array_map(function ($grant) {
return [
'name' => (new users_o())->getCustomerName((int)$grant['billing_customer_number']),
'billing_customer_number' => (int)$grant['billing_customer_number'],
'permissions' => json_decode($grant['permissions'], true) ?: [],
];
services/nginx/nginx.conf
+2 -2
View File
@@ -61,13 +61,13 @@ http {
location ^~ / {
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE";
add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With";
add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number";
add_header Access-Control-Allow-Credentials true;
if ($request_method = 'OPTIONS') {
add_header Access-Control-Allow-Origin *;
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE";
add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With";
add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number";
return 204;
}