Add CORS to /message

app/controllers/messages_controller.rb

@@ -1,8 +1,10 @@
 class MessagesController < ApplicationController
   include CompletionsConcern
 
-  skip_before_action :verify_authenticity_token, only: %i[ create ]
+  skip_before_action :verify_authenticity_token, only: %i[ create cors_preflight_check ]
+  skip_before_action :require_authentication, only: %i[ create cors_preflight_check ]
 
+  before_action :cors_set_access_control_headers, only: %i[ create cors_preflight_check ]
   before_action :set_contest, only: %i[ convert destroy ]
   before_action :set_message, only: %i[ convert destroy ]
   before_action :set_data, only: %i[ convert ]
@@ -11,11 +13,22 @@ class MessagesController < ApplicationController
     super + [ "completions" ]
   end
 
+  def cors_set_access_control_headers
+    response.set_header("Access-Control-Allow-Origin", "https://meet.google.com")
+    response.set_header("Access-Control-Allow-Credentials", "true")
+    response.set_header("Access-Control-Allow-Methods", "POST")
+    response.set_header("Access-Control-Allow-Headers", "*")
+    response.set_header("Access-Control-Max-Age", "86400")
+  end
+
+  def cors_preflight_check
+    skip_authorization
+  end
+
   def create
-    allow_unauthenticated_access
     skip_authorization
 
-    @message_params = message_params
+    begin
       @contest = Contest.find_by_token_for(:token, params[:token])
       @message = Message.new(text: params[:text], author: params[:author], time_seconds: params[:time_seconds],
           display_time: display_time(params[:time_seconds]), contest: @contest)
@@ -28,6 +41,11 @@ class MessagesController < ApplicationController
           format.json  { render json: { error: "invalid contest token" }, status: 400 }
         end
       end
+    rescue
+      respond_to do |format|
+        format.json  { render json: { error: "invalid contest token" }, status: 400 }
+      end
+    end
   end
 
   def convert
@@ -60,8 +78,4 @@ class MessagesController < ApplicationController
     @contestants = @contest.contestants
     @puzzles = @contest.puzzles
   end
-
-  def message_params
-    params.expect(message: [ :author, :text, :time_seconds, :token ])
-  end
 end

config/routes.rb

@@ -24,6 +24,7 @@ Rails.application.routes.draw do
   resource :session
   resources :users
 
+  options "message", to: "messages#cors_preflight_check"
   post "message", to: "messages#create"
 
   get "public/:id", to: "contests#scoreboard"