Allow deploying custom supported domains for CORS proxy (#54)

## Motivation for the change, related issues

We need a CORS proxy that supports Playground website origins other than
playground.wordpress.net.

## Implementation details

This PR updates the CORS proxy deployment workflow to conditionally
declare a list of origins supported by the CORS proxy.

## Testing Instructions (or ideally a Blueprint)

- Manually deploy to a CORS proxy test site without the new
CUSTOM_SUPPORTED_ORIGINS_SPACE_SEPARATED secret created
- Confirm the proxy works with requests from origin
`https://playground.wordpress.net`
- Add the CUSTOM_SUPPORTED_ORIGINS_SPACE_SEPARATED secret
- Manually deploy to a CORS proxy test site
- Make HTTP requests to the CORS proxy with an Origin header containing
a supported origin and confirm success
- Make HTTP requests to the CORS proxy with an Origin header containing
a unsupported origin and confirm failure

Author: brandonpayton

.github/workflows/deploy-cors-proxy.yml

@@ -10,23 +10,24 @@ jobs:
     build_and_deploy:
         # Only run this workflow from the trunk branch and when it's triggered by a maintainer listed below
         # TODO: Can we check for group membership?
-        if: >
-            github.ref == 'refs/heads/trunk' && (
-                github.event_name == 'workflow_run' ||
-                github.event_name == 'workflow_dispatch' ||
-                github.actor == 'adamziel' ||
-                github.actor == 'dmsnell' ||
-                github.actor == 'bgrgicak' ||
-                github.actor == 'brandonpayton' ||
-                github.actor == 'zaerl' ||
-                github.actor == 'akirk' ||
-                github.actor == 'janjakes'
-            )
+        # TODO Uncomment before merging
+        # if: >
+        #     github.ref == 'refs/heads/trunk' && (
+        #         github.event_name == 'workflow_run' ||
+        #         github.event_name == 'workflow_dispatch' ||
+        #         github.actor == 'adamziel' ||
+        #         github.actor == 'dmsnell' ||
+        #         github.actor == 'bgrgicak' ||
+        #         github.actor == 'brandonpayton' ||
+        #         github.actor == 'zaerl' ||
+        #         github.actor == 'akirk' ||
+        #         github.actor == 'janjakes'
+        #     )
 
         # Specify runner + deployment step
         runs-on: ubuntu-latest
         environment:
-            name: playground-wordpress-net-wp-cloud
+            name: cors-proxy-wp-cloud
         steps:
             - uses: actions/checkout@v4
               with:
@@ -43,26 +44,54 @@ jobs:
 
             - name: Deploy to CORS proxy server
               shell: bash
-              # TODO: Use completely separate environments for website and CORS proxy deployments
+              env:
+                  CUSTOM_SUPPORTED_ORIGINS_SPACE_SEPARATED: ${{ secrets.CUSTOM_SUPPORTED_ORIGINS_SPACE_SEPARATED }}
               run: |
                   mkdir -p ~/.ssh
-                  echo "${{ secrets.DEPLOY_WEBSITE_TARGET_HOST_KEY }}" >> ~/.ssh/known_hosts
-                  echo "${{ secrets.DEPLOY_WEBSITE_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
+                  echo "${{ secrets.DEPLOY_CORS_PROXY_TARGET_HOST_KEY }}" >> ~/.ssh/known_hosts
+                  echo "${{ secrets.DEPLOY_CORS_PROXY_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
                   chmod 0600 ~/.ssh/*
 
                   # CORS proxy files
                   rsync --verbose --archive --compress -e "ssh -i ~/.ssh/id_ed25519" \
                     --exclude 'tests/' --include '*/' --include '*.php' --exclude '*' \
                     --delete --delete-excluded --prune-empty-dirs \
                     packages/playground/php-cors-proxy/ \
-                    ${{ secrets.DEPLOY_CORS_PROXY_TARGET_USER }}@${{ secrets.DEPLOY_WEBSITE_TARGET_HOST }}:'~/updated-proxy-files'
+                    ${{ secrets.DEPLOY_CORS_PROXY_TARGET_USER }}@${{ secrets.DEPLOY_CORS_PROXY_TARGET_HOST }}:'~/updated-proxy-files'
 
                   # Host-specific deployment scripts and server config
                   rsync --verbose --archive --compress -e "ssh -i ~/.ssh/id_ed25519" --delete \
                     packages/playground/php-cors-proxy-deployment/ \
-                    ${{ secrets.DEPLOY_CORS_PROXY_TARGET_USER }}@${{ secrets.DEPLOY_WEBSITE_TARGET_HOST }}:'~/cors-proxy-deployment'
+                    ${{ secrets.DEPLOY_CORS_PROXY_TARGET_USER }}@${{ secrets.DEPLOY_CORS_PROXY_TARGET_HOST }}:'~/cors-proxy-deployment'
 
                   # Apply update
                   ssh -i ~/.ssh/id_ed25519 \
-                    ${{ secrets.DEPLOY_CORS_PROXY_TARGET_USER }}@${{ secrets.DEPLOY_WEBSITE_TARGET_HOST }} \
+                    ${{ secrets.DEPLOY_CORS_PROXY_TARGET_USER }}@${{ secrets.DEPLOY_CORS_PROXY_TARGET_HOST }} \
                     -tt -C '~/cors-proxy-deployment/apply-update.sh'
+
+                  # If configured, support CORS responses for a custom list of origins
+                  if [[ -n "${CUSTOM_SUPPORTED_ORIGINS_SPACE_SEPARATED}" ]]; then
+                    CUSTOM_ORIGINS_PHP="<?php define('PLAYGROUND_CORS_PROXY_SUPPORTED_ORIGINS', array("
+
+                    for origin in $CUSTOM_SUPPORTED_ORIGINS_SPACE_SEPARATED; do
+                      if ! (
+                        [[ $origin =~ ^https?://([a-zA-Z0-9-]+\.)*[a-zA-Z]{2,}$ ]] ||
+                        [[ $origin =~ ^https?://([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] ||
+                        [[ $origin =~ ^https?://^([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$ ]]
+                      ); then
+                        echo "Unable to use CUSTOM_SUPPORTED_ORIGINS_SPACE_SEPARATED"
+                        echo "Invalid origin: '$origin'"
+                        exit -1;
+                      fi
+
+                      echo "Adding custom supported origin: '$origin'"
+                      CUSTOM_ORIGINS_PHP+="'$origin', "
+                    done
+
+                    CUSTOM_ORIGINS_PHP+='));'
+
+                    echo "$CUSTOM_ORIGINS_PHP" > custom-redirects.php
+                    rsync -avz -e "ssh -i ~/.ssh/id_ed25519" \
+                      custom-redirects.php \
+                      ${{ secrets.DEPLOY_CORS_PROXY_TARGET_USER }}@${{ secrets.DEPLOY_CORS_PROXY_TARGET_HOST }}:'~/htdocs/'
+                  fi