Shlinkio\Shlink\Rest\Middleware\CrossDomainMiddleware

Complexity

Total Complexity

5

Size/Duplication

Total Lines	39
Duplicated Lines	0 %

Test Coverage

Coverage

100%

Importance

Changes

0

2 Methods

Rating	Name	Duplication	Size	Complexity
A	addOptionsHeaders()	0	20	2
A	process()	0	15	3

<?php

declare(strict_types=1);

namespace Shlinkio\Shlink\Rest\Middleware;

use Fig\Http\Message\RequestMethodInterface;
use Laminas\Diactoros\Response\EmptyResponse;
use Mezzio\Router\RouteResult;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;

use function array_merge;
use function implode;

class CrossDomainMiddleware implements MiddlewareInterface, RequestMethodInterface
{
    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        $response = $handler->handle($request);
        if (! $request->hasHeader('Origin')) {
            return $response;
        }

        // Add Allow-Origin header
        $response = $response->withHeader('Access-Control-Allow-Origin', $request->getHeader('Origin'))
                             ->withHeader('Access-Control-Expose-Headers', AuthenticationMiddleware::API_KEY_HEADER);
        if ($request->getMethod() !== self::METHOD_OPTIONS) {
            return $response;
        }

        return $this->addOptionsHeaders($request, $response);
    }

    private function addOptionsHeaders(ServerRequestInterface $request, ResponseInterface $response): ResponseInterface
    {
        /** @var RouteResult|null $matchedRoute */
        $matchedRoute = $request->getAttribute(RouteResult::class);
        $matchedMethods = $matchedRoute !== null ? $matchedRoute->getAllowedMethods() : [
            self::METHOD_GET,
            self::METHOD_POST,
            self::METHOD_PUT,
            self::METHOD_PATCH,
            self::METHOD_DELETE,
            self::METHOD_OPTIONS,
        ];
        $corsHeaders = [
            'Access-Control-Allow-Methods' => implode(',', $matchedMethods),

It seems like $matchedMethods can also be of type null; however, parameter $pieces of implode() does only seem to accept array, maybe add an additional type check?

            'Access-Control-Max-Age' => '1000',
            'Access-Control-Allow-Headers' => $request->getHeaderLine('Access-Control-Request-Headers'),
        ];

        // Options requests should always be empty and have a 204 status code
        return EmptyResponse::withHeaders(array_merge($response->getHeaders(), $corsHeaders));
    }
}