schemaVersion: "1.0"
pattern:
  id: "8b8167e5de0e69dedb81cacb"
  className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.GenericHostContextSettings"
  name: "IdP-Cors-Filter"
  properties:
    filters: "<filter>\n    <filter-name>Lua_${name}</filter-name>\n    <filter-class>ch::nevis::isiweb4::filter::lua::LuaFilter</filter-class>\n\
      \    <init-param>\n        <param-name>Script.OutputHeaderFunctionName</param-name>\n\
      \        <param-value>outputHeader</param-value>\n    </init-param>\n    <init-param>\n\
      \        <param-name>Script</param-name>\n        <param-value>\n\nfunction\
      \ outputHeader(request, response)\n    trace = request:getTracer()\n    if request:getHeader(\"\
      Origin\") then\n        if not response:getHeader(\"Access-Control-Allow-Origin\"\
      ) then\n           domains = ${param.cors.allowed.fqdns}\n\n           for k,\
      \ v in pairs(domains) do\n             trace:info(\"Accepted domains=\"..v)\n\
      \           end\n\n           domainContainsOrigin = false\n           origin\
      \ = request:getHeader(\"Origin\")\n           if (origin ~= nil) then\n    \
      \         origin = origin:match('^%w+://([^/:]+)')\n             for index,\
      \ value in ipairs(domains) do\n               if (origin == value) then\n  \
      \               response:setHeader(\"Access-Control-Allow-Origin\", origin)\n\
      \                 response:setHeader(\"Vary\", \"Origin\")\n               \
      \  domainContainsOrigin = true\n               end\n             end\n     \
      \        if (not domainContainsOrigin) then\n               request:getTracer():notice(\"\
      VA01\", \"HTTP Origin header \" .. origin .. \" does not match one in the domain\
      \ list \")\n               response:setHeader(\"Content-Type\", \"text/plain\"\
      )\n               response:setBody(\"403 Denied\")\n               response:send(403)\n\
      \               return\n             end\n           end\n            trace:info(\"\
      Proxy allowed CORS for  '\"..response:getHeader(\"Access-Control-Allow-Origin\"\
      )..\"' after receiving a call from origin \"..request:getHeader(\"Origin\"))\n\
      \        else\n          trace:info(\"Backend allowed CORS for '\"..response:getHeader(\"\
      Access-Control-Allow-Origin\")..\"' after receiving a call from origin \"..request:getHeader(\"\
      Origin\"))\n        end\n    else\n      trace:info(\"Origin header is null\"\
      )\n    end\nend\n\n       </param-value>\n    </init-param>\n</filter>\n\n<filter-mapping>\n\
      \    <filter-name>Lua_${name}</filter-name>\n    <url-pattern>/SAML2/SSO/*</url-pattern>\n\
      </filter-mapping>\n"
    phase: "SANITATION"
    parameters: "var://idp-cors-filter-template-parameters"
