Allow preflight requests

Author: Luwangel

app/config/routes.yaml

@@ -29,29 +29,34 @@ game_move:
 api_game_new:
   path: /api/game
   defaults: { _controller: 'App\Controller\ApiController::new' }
-  methods: [POST]
+  methods: [OPTIONS, POST]
 
 api_game:
   path: /api/game/{id}
   defaults: { _controller: 'App\Controller\ApiController::game' }
-  methods: [GET]
+  methods: [OPTIONS, GET]
 
 api_game_cancel:
   path: /api/game/{id}
   defaults: { _controller: 'App\Controller\ApiController::cancel' }
-  methods: [DELETE]
+  methods: [OPTIONS, DELETE]
 
 api_game_join:
   path: /api/game/{id}/join
   defaults: { _controller: 'App\Controller\ApiController::join' }
-  methods: [POST]
+  methods: [OPTIONS, POST]
 
 api_game_move:
   path: /api/game/{id}/move/{tile}
   defaults: { _controller: 'App\Controller\ApiController::move' }
-  methods: [PUT]
+  methods: [OPTIONS, PUT]
 
 api_games:
   path: /api/games/open
   defaults: { _controller: 'App\Controller\ApiController::games' }
-  methods: [GET]
+  methods: [OPTIONS, GET]
+
+api_suggest:
+  path: /api/suggest
+  defaults: { _controller: 'App\Controller\ApiController::suggest' }
+  methods: [OPTIONS, POST]

app/src/Controller/ApiController.php

@@ -30,6 +30,10 @@ public function __construct(GameApi $gameApi, GameRepository $gameRepository, Pl
   }
 
   public function new(Request $request) {
+    if ($request->getMethod() == 'OPTIONS') {
+      return new Response(Response::HTTP_OK);
+    }
+
     $body = json_decode($request->getContent(), true);
     $mode = $body['mode'];
 
@@ -45,7 +49,11 @@ public function new(Request $request) {
     return $response;
   }
 
-  public function game(GameContext $context) {
+  public function game(Request $request, GameContext $context) {
+    if ($request->getMethod() == 'OPTIONS') {
+      return new Response(Response::HTTP_OK);
+    }
+
     $game = $context->getGame();
     $currentPlayer = $context->getPlayer();
     $player = $currentPlayer ?: $game->getPlayer1();
@@ -77,19 +85,25 @@ public function game(GameContext $context) {
     return $response;
   }
 
-  public function cancel(GameContext $context) {
+  public function cancel(Request $request, GameContext $context) {
+    if ($request->getMethod() == 'OPTIONS') {
+      return new Response(Response::HTTP_OK);
+    }
+
     if ($context->getIsPlayer()) {
       $this->gameRepository->remove($context->getGame()->getId());
       return new Response(
         Response::HTTP_OK
       );
     }
-    return new Response(
-      Response::HTTP_INTERNAL_SERVER_ERROR
-    );
+    return new Response(Response::HTTP_INTERNAL_SERVER_ERROR);
   }
 
-  public function join(GameContext $context, TokenGenerator $tokenGenerator) {
+  public function join(Request $request, GameContext $context, TokenGenerator $tokenGenerator) {
+    if ($request->getMethod() == 'OPTIONS') {
+      return new Response(Response::HTTP_OK);
+    }
+
     $game = $context->getGame();
 
     if ($game->isFull()) {
@@ -113,7 +127,11 @@ public function join(GameContext $context, TokenGenerator $tokenGenerator) {
     return $response;
   }
 
-  public function move(GameContext $context, int $tile) {
+  public function move(Request $request, GameContext $context, int $tile) {
+    if ($request->getMethod() == 'OPTIONS') {
+      return new Response(Response::HTTP_OK);
+    }
+
     $game = $context->getGame();
     $currentPlayer = $context->getPlayer();
 
@@ -132,7 +150,11 @@ public function move(GameContext $context, int $tile) {
     return $response;
   }
 
-  public function games() {
+  public function games(Request $request) {
+    if ($request->getMethod() == 'OPTIONS') {
+      return new Response(Response::HTTP_OK);
+    }
+
     $gameIds = $this->gameRepository->findOpenMultiplayerGames();
 
     $response = new JsonResponse();

app/src/Security/CorsListener.php

@@ -8,7 +8,7 @@ class CorsListener {
     public function onKernelResponse(FilterResponseEvent $event) {
         $responseHeaders = $event->getResponse()->headers;
 
-        $responseHeaders->set('Access-Control-Allow-Headers', 'origin, content-type, accept, credentials');
+        $responseHeaders->set('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, Authorization');
         $responseHeaders->set('Access-Control-Allow-Origin', '*');
         $responseHeaders->set('Access-Control-Allow-Credentials', 'true');
         $responseHeaders->set('Access-Control-Allow-Methods', 'POST, GET, PUT, DELETE, PATCH, OPTIONS');