chore(block requests):block localhosts requests to deployment enviroments

- Block requests from localhoste being made to deployment enviroments
Finishes #166203947

Author: [Arusey]

.circleci/config.yml

@@ -36,9 +36,9 @@ gcloud_setup: &gcloud_setup
   run:
     name: setup gcloud
     command: |
-      # install 
+      # install
       sudo curl https://dl.google.com/dl/cloudsdk/release/google-cloud-sdk.tar.gz > /tmp/google-cloud-sdk.tar.gz
-      sudo mkdir -p /usr/local/gcloud 
+      sudo mkdir -p /usr/local/gcloud
       sudo tar -C /usr/local/gcloud -xvf /tmp/google-cloud-sdk.tar.gz
       sudo /usr/local/gcloud/google-cloud-sdk/install.sh --quiet
       echo PATH=$PATH:/usr/local/gcloud/google-cloud-sdk/bin >> ~/.bashrc
@@ -190,7 +190,7 @@ jobs:
           command: |
             ./cc-test-reporter before-build
             . venv/bin/activate
-            coverage combine parallel-coverage/ 
+            coverage combine parallel-coverage/
             coverage xml
             coverage report
             ./cc-test-reporter format-coverage -o ./.coverage -t coverage.py
@@ -221,18 +221,21 @@ jobs:
               echo "CELERY_BROKER_URL"=$(echo $IMAGE_CELERY_BROKER_URL_PRODUCTION) >> .env
               echo "CELERY_RESULT_BACKEND"=$(echo $IMAGE_CELERY_RESULT_BACKEND_PRODUCTION) >> .env
               echo "MRM_PUSH_URL"=$(echo $IMAGE_MRM_PUSH_URL_PRODUCTION) >> .env
+              echo "PROD_REQUEST_URL"=$(echo $IMAGE_PROD_REQUEST_URL) >> .env
             elif [ "$CIRCLE_BRANCH" == develop ]; then
               echo "DEV_DATABASE_URL"=$(echo $IMAGE_DEV_DATABASE_URL_STAGING) >> .env
               echo "DATABASE_URL"=$(echo $IMAGE_DATABASE_URL_STAGING) >> .env
               echo "CELERY_BROKER_URL"=$(echo $IMAGE_CELERY_BROKER_URL_STAGING) >> .env
               echo "CELERY_RESULT_BACKEND"=$(echo $IMAGE_CELERY_RESULT_BACKEND_STAGING) >> .env
               echo "MRM_PUSH_URL"=$(echo $IMAGE_MRM_PUSH_URL_STAGING) >> .env
+              echo "PROD_REQUEST_URL"=$(echo $IMAGE_PROD_REQUEST_URL) >> .env
             else
               echo "DEV_DATABASE_URL"=$(echo $IMAGE_DEV_DATABASE_URL_SANDBOX) >> .env
               echo "DATABASE_URL"=$(echo $IMAGE_DATABASE_URL_SANDBOX) >> .env
               echo "CELERY_BROKER_URL"=$(echo $IMAGE_CELERY_BROKER_URL_SANDBOX) >> .env
               echo "CELERY_RESULT_BACKEND"=$(echo $IMAGE_CELERY_RESULT_BACKEND_SANDBOX) >> .env
               echo "MRM_PUSH_URL"=$(echo $IMAGE_MRM_PUSH_URL_SANDBOX) >> .env
+              echo "PROD_REQUEST_URL"=$(echo $IMAGE_PROD_REQUEST_URL) >> .env
             fi
             echo "SECRET_KEY"=$(echo $IMAGE_SECRET_KEY) >> .env
             echo "MAIL_SERVER"=$(echo $IMAGE_MAIL_SERVER) >> .env
@@ -301,13 +304,13 @@ jobs:
           command: |
             if [ "$CIRCLE_BRANCH" == master ] || [ "$CIRCLE_BRANCH" == develop ]; then
               touch google-service-key.json
-              echo $GOOGLE_CREDENTIALS_STAGING | base64 --decode >> google-service-key.json 
+              echo $GOOGLE_CREDENTIALS_STAGING | base64 --decode >> google-service-key.json
               gcloud auth activate-service-account --key-file google-service-key.json
               gcloud --quiet config set project ${GOOGLE_PROJECT_ID_STAGING}
               gcloud --quiet config set compute/zone ${GOOGLE_COMPUTE_ZONE}
             else
               touch google-service-key.json
-              echo $GOOGLE_CREDENTIALS_SANDBOX | base64 --decode >> google-service-key.json 
+              echo $GOOGLE_CREDENTIALS_SANDBOX | base64 --decode >> google-service-key.json
               gcloud auth activate-service-account --key-file google-service-key.json
               gcloud --quiet config set project ${GOOGLE_PROJECT_ID_SANDBOX}
               gcloud --quiet config set compute/zone ${GOOGLE_COMPUTE_ZONE}

app.py

@@ -1,7 +1,6 @@
 from flask import Flask, render_template
 
 from flask_graphql import GraphQLView
-from flask_cors import CORS
 from flask_json import FlaskJSON
 
 from flask_mail import Mail
@@ -17,7 +16,6 @@
 
 def create_app(config_name):
     app = Flask(__name__)
-    CORS(app)
     FlaskJSON(app)
     app.config.from_object(config[config_name])
     config[config_name].init_app(app)
@@ -35,6 +33,7 @@ def index():
             graphiql=True   # for having the GraphiQL interface
         )
     )
+
     app.add_url_rule(
         '/_healthcheck',
         view_func=GraphQLView.as_view(

helpers/auth/allowed_requests.py

@@ -0,0 +1,20 @@
+import os
+from flask import request
+from graphql import GraphQLError
+
+request_urls = os.environ.get("PROD_REQUEST_URL").split(',')
+
+
+class RequestAuthentication:
+
+    def validate_origins(self):
+        if request.environ['HTTP_ORIGIN'] in request.environ and request.environ['HTTP_ORIGIN'] not in request_urls:  # noqa 501
+            raise GraphQLError(
+                "You are not allowed to make requests to this environment")
+        else:
+            response.headers.add('Access-Control-Allow-Origin', request.environ['HTTP_ORIGIN'] )
+            response.headers.add('Access-Control-Allow-Headers', 'access-control-allow-origin,content-type')  # noqa 501
+            response.headers.add('Access-Control-Allow-Methods', 'GET,POST')
+
+
+Request = RequestAuthentication()

manage.py

@@ -2,20 +2,28 @@
 
 import bugsnag
 from flask_script import Manager, Shell
+from flask_cors import CORS
+from helpers.auth.allowed_requests import Request
 from bugsnag.flask import handle_exceptions
 
 
 # Configure bugnsag
 bugsnag.configure(
-  api_key=os.getenv('BUGSNAG_API_TOKEN'),
-  release_stage="development",
-  project_root="app"
+    api_key=os.getenv('BUGSNAG_API_TOKEN'),
+    release_stage="development",
+    project_root="app"
 )
 
 # local imports
 from app import create_app  # noqa: E402
 
 app = create_app(os.getenv('APP_SETTINGS') or 'default')
+with app.test_request_context():
+    if app.config['DEBUG'] or app.config['TESTING']:
+        CORS(app, resources={r"/mrm": {"origins": "*"}})
+    else:
+        Request.validate_origins()
+
 handle_exceptions(app)
 manager = Manager(app)
 

requirements.txt

@@ -4,7 +4,7 @@ blinker==1.4
 celery==3.1.17
 coverage==4.5.1
 Flask==0.12.2
-Flask-Cors==3.0.4
+Flask-Cors==3.0.7
 Flask-JSON==0.3.2
 Flask-Script==2.0.6
 Flask-GraphQL==1.4.1