feat: [SRTP-43] add cors policy (#4)

Co-authored-by: petretiandrea <[email protected]>

src/rtp/01_apim_core.tf

@@ -18,7 +18,10 @@ resource "azurerm_api_management_product_policy" "rtp_api_product" {
   api_management_name = data.azurerm_api_management.this.name
   resource_group_name = data.azurerm_api_management.this.resource_group_name
 
-  xml_content = file("./api_product/base_policy.xml")
+  xml_content = templatefile("./api_product/base_policy.xml", {
+    rtp_fe_origin = local.rtp_fe_origin,
+    dev_origin    = var.env_short != "d" ? "" : "\n<origin>http://localhost:1234</origin>"
+  })
 }
 
 resource "azurerm_api_management_group" "rtp_group" {

src/rtp/99_locals.tf

@@ -5,5 +5,6 @@ locals {
   apim_name = "${local.product}-apim"
   apim_rg   = "${local.product}-api-rg"
 
-  rtp_base_url = "https://api-rtp.${var.dns_zone_prefix}"
+  rtp_base_url  = "https://api-rtp.${var.dns_zone_prefix}"
+  rtp_fe_origin = "${var.domain}.${var.dns_zone_prefix}"
 }

src/rtp/api/pagopa/create_rtp_mock_policy.xml

@@ -12,6 +12,7 @@
 -->
 <policies>
     <inbound>
+        <base />
         <set-variable name="uuid" value="@(Guid.NewGuid().ToString())"/>
         <return-response>
             <set-status code="200" reason="OK" />

src/rtp/api_product/base_policy.xml

@@ -12,7 +12,20 @@
 -->
 <policies>
   <inbound>
-    <base />
+    <cors allow-credentials="true">
+      <allowed-origins>
+        <origin>https://${rtp_fe_origin}</origin>${dev_origin}
+      </allowed-origins>
+      <allowed-methods preflight-result-max-age="300">
+        <method>*</method>
+      </allowed-methods>
+      <allowed-headers>
+        <header>*</header>
+      </allowed-headers>
+      <expose-headers>
+        <header>*</header>
+      </expose-headers>
+    </cors>
   </inbound>
   <backend>
     <base />