fix(server): asset cors middleware (#1810)

Author: soneda-yuya

server/internal/app/internal/middleware/assets_cors_middleware.go

@@ -2,6 +2,8 @@ package middleware
 
 import (
 	"net/http"
+	"net/url"
+	"strings"
 
 	"github.com/labstack/echo/v4"
 	"github.com/reearth/reearth/server/internal/usecase/gateway"
@@ -23,8 +25,13 @@ func AssetsCORSMiddleware(domainChecker gateway.DomainChecker, allowedOrigins []
 				}
 			}
 			if allowedOrigin == "" {
+				domain, err := extractDomain(origin)
+				if err != nil {
+					log.Errorfc(c.Request().Context(), "[AssetsCORSMiddleware] extract domain err: %v", err)
+					return next(c)
+				}
 				domainResp, err := domainChecker.CheckDomain(c.Request().Context(), gateway.DomainCheckRequest{
-					Domain: origin,
+					Domain: domain,
 				})
 				if err != nil {
 					log.Errorfc(c.Request().Context(), "[AssetsCORSMiddleware] domain checker check domain err: %v", err)
@@ -46,3 +53,17 @@ func AssetsCORSMiddleware(domainChecker gateway.DomainChecker, allowedOrigins []
 		}
 	}
 }
+
+func extractDomain(raw string) (string, error) {
+	u, err := url.Parse(raw)
+	if err != nil {
+		return "", err
+	}
+
+	host := u.Host
+	if strings.Contains(host, ":") {
+		host = strings.Split(host, ":")[0]
+	}
+
+	return host, nil
+}

server/internal/app/internal/middleware/assets_cors_middleware_test.go

@@ -77,7 +77,7 @@ func TestAssetsCORSMiddleware(t *testing.T) {
 
 			mockChecker := &mockDomainChecker{
 				checkFunc: func(ctx context.Context, req gateway.DomainCheckRequest) (*gateway.DomainCheckResponse, error) {
-					if req.Domain == "https://custom.com" {
+					if req.Domain == "custom.com" {
 						return &gateway.DomainCheckResponse{Allowed: true}, nil
 					}
 					return &gateway.DomainCheckResponse{Allowed: false}, nil
@@ -468,7 +468,7 @@ func TestAssetsCORSMiddleware_EdgeCases(t *testing.T) {
 
 		mockChecker := &mockDomainChecker{
 			checkFunc: func(ctx context.Context, req gateway.DomainCheckRequest) (*gateway.DomainCheckResponse, error) {
-				if req.Domain == "https://example.com/" {
+				if req.Domain == "example.com" {
 					return &gateway.DomainCheckResponse{Allowed: true}, nil
 				}
 				return &gateway.DomainCheckResponse{Allowed: false}, nil

server/internal/infrastructure/domain/http_checker.go

@@ -45,13 +45,18 @@ func (h *HTTPDomainChecker) CheckDomain(ctx context.Context, req gateway.DomainC
 	}
 
 	resp, err := h.client.Do(httpReq)
+
 	if err != nil {
 		return nil, rerror.ErrInternalBy(fmt.Errorf("domain check request failed: %w", err))
 	}
 	defer func() {
 		_ = resp.Body.Close()
 	}()
 
+	if resp.StatusCode == http.StatusNotFound {
+		return &gateway.DomainCheckResponse{Allowed: false}, nil
+	}
+
 	if resp.StatusCode != http.StatusOK {
 		return nil, rerror.ErrInternalBy(fmt.Errorf("domain check returned status %d", resp.StatusCode))
 	}