split handler and cors into separate files

bin/cors.ml

@@ -0,0 +1,35 @@
+let allowed_origins =
+  [
+    "https://chess-scribe.org";
+    "https://www.chess-scribe.org";
+    "http://localhost:3000";
+  ]
+
+let is_dev_mode () =
+  Array.to_list Sys.argv
+  |> List.exists (fun arg -> arg = "DREAM_ENV=development")
+
+let middleware next_handler request =
+  let allowed_origin =
+    if is_dev_mode () then "*"
+    else
+      match Dream.header request "Origin" with
+      | Some origin when List.mem origin allowed_origins -> origin
+      | _ -> "https://chess-scribe.org"
+  in
+
+  if Dream.method_ request = `OPTIONS then (
+    let response = Dream.response "" in
+    Dream.add_header response "Access-Control-Allow-Origin" allowed_origin;
+    Dream.add_header response "Access-Control-Allow-Methods"
+      "POST, GET, OPTIONS";
+    Dream.add_header response "Access-Control-Allow-Headers"
+      "Content-Type, Authorization";
+    Dream.add_header response "Access-Control-Max-Age" "86400";
+    Dream.set_status response `No_Content;
+    Lwt.return response)
+  else
+    let open Lwt.Syntax in
+    let* response = next_handler request in
+    Dream.add_header response "Access-Control-Allow-Origin" allowed_origin;
+    Lwt.return response