/*
 * Copyright 2015 - 2016 Anton Tananaev (anton.tananaev@gmail.com)
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.traccar.api;

import org.jboss.netty.handler.codec.http.HttpHeaders;
import org.traccar.Context;

import java.io.IOException;
import javax.ws.rs.container.ContainerRequestContext;
import javax.ws.rs.container.ContainerResponseContext;
import javax.ws.rs.container.ContainerResponseFilter;

public class CorsResponseFilter implements ContainerResponseFilter {

    public static final String ACCESS_CONTROL_ALLOW_ORIGIN_KEY = "Access-Control-Allow-Origin";
    public static final String ACCESS_CONTROL_ALLOW_ORIGIN_VALUE = "*";

    public static final String ACCESS_CONTROL_ALLOW_HEADERS_KEY = "Access-Control-Allow-Headers";
    public static final String ACCESS_CONTROL_ALLOW_HEADERS_VALUE = "origin, content-type, accept, authorization";

    public static final String ACCESS_CONTROL_ALLOW_CREDENTIALS_KEY = "Access-Control-Allow-Credentials";
    public static final String ACCESS_CONTROL_ALLOW_CREDENTIALS_VALUE = "true";

    public static final String ACCESS_CONTROL_ALLOW_METHODS_KEY = "Access-Control-Allow-Methods";
    public static final String ACCESS_CONTROL_ALLOW_METHODS_VALUE = "GET, POST, PUT, DELETE, OPTIONS";

    @Override
    public void filter(ContainerRequestContext request, ContainerResponseContext response) throws IOException {
        if (!response.getHeaders().containsKey(ACCESS_CONTROL_ALLOW_HEADERS_KEY)) {
            response.getHeaders().add(ACCESS_CONTROL_ALLOW_HEADERS_KEY, ACCESS_CONTROL_ALLOW_HEADERS_VALUE);
        }
        if (!response.getHeaders().containsKey(ACCESS_CONTROL_ALLOW_CREDENTIALS_KEY)) {
            response.getHeaders().add(ACCESS_CONTROL_ALLOW_CREDENTIALS_KEY, ACCESS_CONTROL_ALLOW_CREDENTIALS_VALUE);
        }
        if (!response.getHeaders().containsKey(ACCESS_CONTROL_ALLOW_METHODS_KEY)) {
            response.getHeaders().add(ACCESS_CONTROL_ALLOW_METHODS_KEY, ACCESS_CONTROL_ALLOW_METHODS_VALUE);
        }

        if (!response.getHeaders().containsKey(ACCESS_CONTROL_ALLOW_ORIGIN_KEY)) {
            String origin = request.getHeaderString(HttpHeaders.Names.ORIGIN);
            String allowed = Context.getConfig().getString("web.origin");

            if (allowed == null || origin == null) {
                response.getHeaders().add(ACCESS_CONTROL_ALLOW_ORIGIN_KEY, ACCESS_CONTROL_ALLOW_ORIGIN_VALUE);
            } else if (allowed.equals(ACCESS_CONTROL_ALLOW_ORIGIN_VALUE) || allowed.contains(origin)) {
                response.getHeaders().add(ACCESS_CONTROL_ALLOW_ORIGIN_KEY, origin);
            }
        }
    }

}

@@ -1006,171 +1006,53 @@
    p
-ublic static final String ACCESS_CONTROL_ALLOW_ORIGIN_KEY = %22Access-Control-Allow-Origin%22;%0A    public static final String ACCESS_CONTROL_ALLOW_
+rivate static final String 
 ORIGIN_
-V
 AL
-UE
+L
  = %22*%22;%0A
 %0A   
@@ -1051,167 +1051,48 @@
 *%22;%0A
-%0A
     p
-ublic static final String ACCESS_CONTROL_ALLOW_HEADERS_KEY = %22Access-Control-Allow-Headers%22;%0A    public static final String ACCESS_CONTROL_ALLOW_
+rivate static final String 
 HEADERS_
 VALU
@@ -1087,21 +1087,19 @@
 HEADERS_
-V
 AL
-UE
+L
  = %22orig
@@ -1144,359 +1144,51 @@
 n%22;%0A
-%0A
     p
-ublic static final String ACCESS_CONTROL_ALLOW_CREDENTIALS_KEY = %22Access-Control-Allow-Credentials%22;%0A    public static final String ACCESS_CONTROL_ALLOW_CREDENTIALS_VALUE = %22true%22;%0A%0A    public static final String ACCESS_CONTROL_ALLOW_METHODS_KEY = %22Access-Control-Allow-Methods%22;%0A    public static final String ACCESS_CONTROL_ALLOW_METHODS_VALUE
+rivate static final String METHODS_ALL
  = %22
@@ -1387,32 +1387,50 @@
 s().containsKey(
+HttpHeaders.Names.
 ACCESS_CONTROL_A
@@ -1441,25 +1441,96 @@
 _HEADERS
-_KEY
 )) %7B%0A
+            String headers = Context.getConfig().getString(%22web.origin%22);%0A%0A
         
@@ -1551,32 +1551,50 @@
 etHeaders().add(
+HttpHeaders.Names.
 ACCESS_CONTROL_A
@@ -1609,43 +1609,18 @@
 DERS
-_KEY, ACCESS_CONTROL_ALLOW_
+, 
 HEADERS_
 VALU
@@ -1615,21 +1615,19 @@
 HEADERS_
-V
 AL
-UE
+L
 );%0A     
@@ -1623,32 +1623,33 @@
 ALL);%0A        %7D%0A
+%0A
         if (!res
@@ -1671,32 +1671,50 @@
 s().containsKey(
+HttpHeaders.Names.
 ACCESS_CONTROL_A
@@ -1729,20 +1729,16 @@
 DENTIALS
-_KEY
 )) %7B%0A   
@@ -1764,32 +1764,50 @@
 etHeaders().add(
+HttpHeaders.Names.
 ACCESS_CONTROL_A
@@ -1826,52 +1826,14 @@
 IALS
-_KEY, ACCESS_CONTROL_ALLOW_CREDENTIALS_VALUE
+, true
 );%0A 
@@ -1833,32 +1833,33 @@
 rue);%0A        %7D%0A
+%0A
         if (!res
@@ -1881,32 +1881,50 @@
 s().containsKey(
+HttpHeaders.Names.
 ACCESS_CONTROL_A
@@ -1935,20 +1935,16 @@
 _METHODS
-_KEY
 )) %7B%0A   
@@ -1970,32 +1970,50 @@
 etHeaders().add(
+HttpHeaders.Names.
 ACCESS_CONTROL_A
@@ -2028,43 +2028,18 @@
 HODS
-_KEY, ACCESS_CONTROL_ALLOW_
+, 
 METHODS_
 VALU
@@ -2034,21 +2034,19 @@
 METHODS_
-V
 AL
-UE
+L
 );%0A     
@@ -2098,16 +2098,34 @@
 ainsKey(
+HttpHeaders.Names.
 ACCESS_C
@@ -2143,20 +2143,16 @@
 W_ORIGIN
-_KEY
 )) %7B%0A   
@@ -2389,32 +2389,50 @@
 etHeaders().add(
+HttpHeaders.Names.
 ACCESS_CONTROL_A
@@ -2446,47 +2446,20 @@
 IGIN
-_KEY, ACCESS_CONTROL_ALLOW_
+, 
 ORIGIN_
-V
 AL
-UE
+L
 );%0A 
@@ -2499,41 +2499,18 @@
 als(
-ACCESS_CONTROL_ALLOW_
 ORIGIN_
-V
 AL
-UE
+L
 ) %7C%7C
@@ -2580,16 +2580,34 @@
 s().add(
+HttpHeaders.Names.
 ACCESS_C
@@ -2629,12 +2629,8 @@
 IGIN
-_KEY
 , or

Refactor CORS response filter