Initial commit

app/controllers/carto/api/public/application_controller.rb

@@ -0,0 +1,42 @@
+class Carto::Api::Public::ApplicationController < ::Api::ApplicationController
+  include Carto::Api::AuthApiAuthentication
+
+  # Override all CORS settings
+  skip_before_action :cors_preflight_check
+  skip_after_action :allow_cross_domain_access
+  before_action :allow_full_cross_domain_access
+
+  # Only allow API Key authorization
+  skip_before_action :http_header_authentication, :api_authorization_required
+  prepend_before_action :only_api_key_authorization
+
+  # Disable authorization check for OPTIONS
+  skip_before_action :only_api_key_authorization, only: [:options]
+
+  WARDEN_SCOPE = :$public_api_scope
+
+  def allow_full_cross_domain_access
+    response.headers['Access-Control-Allow-Origin'] = '*'
+    response.headers['Access-Control-Allow-Methods'] = '*'
+    response.headers['Access-Control-Allow-Headers'] = 'Authorization'
+  end
+
+  def options
+    head :ok
+  end
+
+  # Override current_user and current_viewer so they only return the user authenticated via API Key (ignore session)
+  def current_user
+    warden.user(WARDEN_SCOPE)
+  end
+
+  def current_viewer
+    current_user
+  end
+
+  private
+
+  def only_api_key_authorization
+    authenticate!(:any_auth_api, :api_authentication, scope: WARDEN_SCOPE)
+  end
+end