From 2da6bd6d1c3b07e08e6e0925868c38e5d6421676 Mon Sep 17 00:00:00 2001
From: Kyle Russell <bkylerussell@gmail.com>
Date: Sat, 20 Oct 2018 22:19:30 -0400
Subject: [PATCH] Config: apply CorsResourcePolicy to PUT requests

PUT requests are part of the public upsert API, so if postgrest
runs at a different origin, these requests will fail because they
don't pass CORS.
---
 src/PostgREST/Config.hs  | 2 +-
 test/Feature/CorsSpec.hs | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/PostgREST/Config.hs b/src/PostgREST/Config.hs
index d2030cbb4..621a4fe6e 100644
--- a/src/PostgREST/Config.hs
+++ b/src/PostgREST/Config.hs
@@ -82,7 +82,7 @@ data AppConfig = AppConfig {
 
 defaultCorsPolicy :: CorsResourcePolicy
 defaultCorsPolicy =  CorsResourcePolicy Nothing
-  ["GET", "POST", "PATCH", "DELETE", "OPTIONS"] ["Authorization"] Nothing
+  ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"] ["Authorization"] Nothing
   (Just $ 60*60*24) False False True
 
 -- | CORS policy to be used in by Wai Cors middleware
diff --git a/test/Feature/CorsSpec.hs b/test/Feature/CorsSpec.hs
index 2efcd9673..f8e3cd243 100644
--- a/test/Feature/CorsSpec.hs
+++ b/test/Feature/CorsSpec.hs
@@ -45,7 +45,7 @@ spec =
             "true"
           respHeaders `shouldSatisfy` matchHeader
             "Access-Control-Allow-Methods"
-            "GET, POST, PATCH, DELETE, OPTIONS, HEAD"
+            "GET, POST, PATCH, PUT, DELETE, OPTIONS, HEAD"
           respHeaders `shouldSatisfy` matchHeader
             "Access-Control-Allow-Headers"
             "Authentication, Foo, Bar, Accept, Accept-Language, Content-Language"