API: Allow CORS API requests no matter what FQDN the UI is hosted on

[peteski22]

What's changing

This PR changes the backend API configuration to allow setting the CORS allowed origins that are accepted. It also defaults to http://localhost and http://localhost:3000 when nothing is configured.

Previously it was limited to only accepting requests from the UI when it the UI is hosted via HTTP on localhost ports 80 or 3000.

How to test it

• gh pr checkout 441

1. No environment variable set

This example starts Lumigator with no env var configured, the default will be used.

• make local-up
• cd lumigator/frontend
• npm install
• npm run dev

Open http://127.0.0.1:3000 in a browser and the health check (top right) should report OK (no errors shown, no errors in the developer tools network tab/console).

Also the logs in the backend container will show:

INFO     | backend.main:create_app:57 - Configuring CORS for API, allowed origins: ['http://localhost', 'http://localhost:3000']

2. Configure local environment variable

This example starts Lumigator specifying a list of allowed origins that should be used.

• LUMI_API_CORS_ALLOWED_ORIGINS="http://localhost:8080" make local-up
  (note: you can also use LUMI_API_CORS_ALLOWED_ORIGINS="*" make local-up to allow all)
• cd lumigator/frontend
• npm install
• npm run build
• cd dist
• npx http-server

Open http://127.0.0.1:8080 in a browser and the health check (top right) should report OK (no errors shown, no errors in the developer tools network tab/console).

Also the logs in the backend container will show:

INFO     | backend.main:create_app:57 - Configuring CORS for API, allowed origins: ['http://localhost:8080']

3. Configure environment variable without required origin

This example starts Lumigator, specifying allowed origins, but NOT the one for 8080 which is required for our test UI to work.

• LUMI_API_CORS_ALLOWED_ORIGINS="http://localhost:9999" make local-up
• cd lumigator/frontend
• npm install
• npm run build
• cd dist
• npx http-server

Open http://127.0.0.1:8080 in a browser and the health check (top right) should fail.

Also the logs in the backend container will show:

INFO     | backend.main:create_app:57 - Configuring CORS for API, allowed origins: ['http://localhost:9999']

Additional notes for reviewers

The UI is hosted on 8080 in this example, which means a CORS pre-flight OPTIONS request will be sent to the backend asking if it allows cross-domain requests from 'http://localhost:8080' (the scheme+host+port are important to CORS).

Previously only http://localhost:80 and http://localhost:3000 were allowed so the UI would fail to make requests to the API to get health status, datasets etc. but now it works.

I already...

• added some tests for any new functionality
• updated the documentation
• checked if a (backend) DB migration step was required and included it if required

[agpituk]

Thanks for all the changes! looks good!! :)