Added --cors argument to enable CORS

Closes #75

datasette/app.py

@@ -48,7 +48,8 @@ class BaseView(HTTPMethodView):
 
     def options(self, request, *args, **kwargs):
         r = response.text('ok')
-        r.headers['Access-Control-Allow-Origin'] = '*'
+        if self.ds.cors:
+            r.headers['Access-Control-Allow-Origin'] = '*'
         return r
 
     def redirect(self, request, path):
@@ -58,7 +59,8 @@ class BaseView(HTTPMethodView):
             )
         r = response.redirect(path)
         r.headers['Link'] = '<{}>; rel=preload'.format(path)
-        r.headers['Access-Control-Allow-Origin'] = '*'
+        if self.ds.cors:
+            r.headers['Access-Control-Allow-Origin'] = '*'
         return r
 
     async def pks_for_table(self, name, table):
@@ -174,15 +176,16 @@ class BaseView(HTTPMethodView):
                         dict(zip(columns, row))
                         for row in rows
                     ]
+            headers = {}
+            if self.ds.cors:
+                headers['Access-Control-Allow-Origin'] = '*'
             r = response.HTTPResponse(
                 json.dumps(
                     data, cls=CustomJSONEncoder
                 ),
                 status=status_code,
                 content_type='application/json',
-                headers={
+                headers=headers,
-                    'Access-Control-Allow-Origin': '*'
-                }
             )
         else:
             context = {**data, **dict(
@@ -473,7 +476,7 @@ class RowView(BaseView):
 
 
 class Datasette:
-    def __init__(self, files, num_threads=3, cache_headers=True, page_size=50, inspect_data=None, metadata=None):
+    def __init__(self, files, num_threads=3, cache_headers=True, page_size=50, cors=False, inspect_data=None, metadata=None):
         self.files = files
         self.num_threads = num_threads
         self.executor = futures.ThreadPoolExecutor(
@@ -481,6 +484,7 @@ class Datasette:
         )
         self.cache_headers = cache_headers
         self.page_size = page_size
+        self.cors = cors
         self._inspect = inspect_data
         self.metadata = metadata
 

datasette/cli.py

@@ -87,9 +87,10 @@ def package(files, tag, metadata):
 @click.option('-p', '--port', default=8001)
 @click.option('--debug', is_flag=True)
 @click.option('--reload', is_flag=True)
+@click.option('--cors', is_flag=True)
 @click.option('--inspect-file')
 @click.option('-m', '--metadata', type=click.File(mode='r'))
-def serve(files, host, port, debug, reload, inspect_file, metadata):
+def serve(files, host, port, debug, reload, cors, inspect_file, metadata):
     """Serve up specified database files with a web UI"""
     if reload:
         import hupper
@@ -107,6 +108,7 @@ def serve(files, host, port, debug, reload, inspect_file, metadata):
     ds = Datasette(
         files,
         cache_headers=not debug and not reload,
+        cors=cors,
         inspect_data=inspect_data,
         metadata=metadata_data,
     )

datasette/utils.py

@@ -143,7 +143,7 @@ WORKDIR /app
 RUN pip install https://static.simonwillison.net/static/2017/datasette-0.6-py3-none-any.whl
 RUN datasette build {} --inspect-file inspect-data.json
 EXPOSE 8001
-CMD ["datasette", "serve", {}, "--port", "8001", "--inspect-file", "inspect-data.json"{}]'''.format(
+CMD ["datasette", "serve", {}, "--port", "8001", "--cors", "--inspect-file", "inspect-data.json"{}]'''.format(
         ' '.join(files),
         '"' + '", "'.join(files) + '"',
         metadata_file and ', "--metadata", "{}"'.format(metadata_file) or '',