test(gw): improve CORS tests

[lidel]

This PR cleans up old CORS tests and adds more resolution:

• CORS on Gateway port: proper origin, testing custom header behavior
• CORS on API port: fix CORS preflight requests to RPC API with custom headers #7667
  • Descoped as it needs to be revisited given the latest sources and gateway practices, let's continue in CORS preflight requests to RPC API with custom headers #7667

[mar1n3r0]

Tests for the examples you have provided here : #7667

# HTTP OPTIONS Request
test_expect_success "OPTIONS to {gw}/api/v0 succeeds" '
  curl -svX OPTIONS -H "Origin: https://example.com" "http://127.0.0.1:$GWAY_PORT/api/v0/cat?arg=$thash" 2>curl_output
'
# OPTIONS Response from the API should NOT contain CORS headers
test_expect_success "OPTIONS response from {gw}/api/v0 has no CORS header" '
  cat curl_output &&
  grep -q "Access-Control-Allow-" curl_output && false || true
'

test_kill_ipfs_daemon

# Test CORS safelisting of standard headers
test_expect_success "Can configure standard CORS headers" '
  ipfs config --json Gateway.HTTPHeaders.Access-Control-Allow-Headers "[\"Content-Disposition\"]" &&
  ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin  "[\"https://example.com\"]" &&
  ipfs config --json API.HTTPHeaders.Access-Control-Allow-Methods "[\"PUT\", \"POST\"]"
'

test_launch_ipfs_daemon

# HTTP OPTIONS POST Request
test_expect_success "OPTIONS to {gw}/api/v0 CORS headers" '
  curl -svX OPTIONS -H "Access-Control-Request-Method: POST" -H "Access-Control-Request-Headers: Content-Disposition" -H "Origin: https://example.com" "http://127.0.0.1:$GWAY_PORT/api/v0/cat?arg=$thash" 2>curl_output
'

# OPTIONS POST Response from the API should contain custom CORS headers
test_expect_success "OPTIONS response from {gw}/api/v0 has custom CORS header" '
  test_expect_code 1 grep "< Access-Control-Allow-Headers: Content-Disposition" curl_output
'

# OPTIONS POST Response from the API should contain default CORS headers
test_expect_success "OPTIONS response from {gw}/api/v0 has default CORS headers " '
  grep "< Access-Control-Allow-Methods: POST" curl_output &&
  grep "< Access-Control-Allow-Origin: https://example.com" curl_output
'

[mar1n3r0]

test_expect_success "OPTIONS to RPC API (exposed on the Gateway Port) with a custom header succeeds" '
  curl -svX OPTIONS -H "Origin: https://example.com" -H "Access-Control-Request-Headers: Content-Disposition" "http://127.0.0.1:$GWAY_PORT/api/v0/cat?args=$thash" 2>curl_output &&
  cat curl_output
'
test_expect_success "Access-Control-Allow-Headers extends the previous implicit list" '
  test_expect_code 1 grep "< Access-Control-Allow-Headers: Content-Disposition" curl_output
'

[lidel]

I've rebased this to get more confidence around CORS behavior ( && false || true bits were 🙈)

Thank you for submitting tests in comments, they will be useful when someone has time for #7667