api specs

phoenix/lib/shooting_event_phx_web/plugs/admin_only.ex

@@ -0,0 +1,18 @@
+defmodule ShootingEventPhxWeb.Plugs.AdminOnly do
+  @moduledoc false
+  import Plug.Conn
+  alias ShootingEventPhx.Auth
+
+  def init(opts), do: opts
+
+  def call(conn, _opts) do
+    if Auth.admin_request?(conn) do
+      conn
+    else
+      conn
+      |> put_status(:unauthorized)
+      |> Phoenix.Controller.json(%{"message" => "invalid or expired admin token"})
+      |> halt()
+    end
+  end
+end

phoenix/lib/shooting_event_phx_web/plugs/cors.ex

@@ -0,0 +1,20 @@
+defmodule ShootingEventPhxWeb.Plugs.CORS do
+  @moduledoc false
+  import Plug.Conn
+
+  def init(opts), do: opts
+
+  def call(conn, _opts) do
+    conn =
+      conn
+      |> put_resp_header("access-control-allow-origin", "*")
+      |> put_resp_header("access-control-allow-methods", "GET,POST,PUT,DELETE,OPTIONS")
+      |> put_resp_header("access-control-allow-headers", "content-type,authorization")
+
+    if conn.method == "OPTIONS" do
+      conn |> send_resp(204, "") |> halt()
+    else
+      conn
+    end
+  end
+end