Fix #19

README.md

@@ -55,7 +55,8 @@ vi lutim.conf
 * https: 1 if you want to provide secure images URLs (default is 0) ;
 * stats\_day\_num: when you generate statistics with `script/lutim cron stats`, you will have stats for the last `stats_day_num` days (default is 365) ;
 * keep\_ip\_during: when you delete IP addresses of image's senders with `script/lutim cron cleanbdd`, the IP addresses of images older than `keep_ip_during` days will be deleted (default is 365) ;
-* broadcast\_message: put some string (not HTML) here and this message will be displayed on all LUTIm pages (not in JSON responses)
+* broadcast\_message: put some string (not HTML) here and this message will be displayed on all LUTIm pages (not in JSON responses) ;
+* allowed\_domains: array of authorized domains for API calls. Example: `['http://1.example.com', 'http://2.example.com']`. If you want to authorize everyone to use the API: `['*']`.
 
 ##Usage
 ```
@@ -134,6 +135,26 @@ carton exec hypnotoad script/lutim
 
 It may take a few reload before the message is displayed.
 
+##API
+You can add images by using the API. Here's the parameters of the `POST` request to `/` adress:.
+* format: json
+    MANDATORY if you want to get a json response, otherwise it will send a web page
+* file: the image file
+    MANDATORY
+* delete-day: number of days you want the image to stay
+    OPTIONAL if 0, it will be available undefinitely
+* first-view: 1
+    OPTIONAL if not 0, the image will be deleted at first view
+
+
+Exemple with curl:
+```shell
+curl -F "format=json" -F "file=@/tmp/snap0001.jpg" http://lut.im
+```
+
+You can allow people to use your instance of LUTIm from other domains.
+Add the allowed domains as an array in the `allowed_domains` conf option. Put '`[*]`' if you want to allow all domains.
+
 ##Shutter integration
 See where Shutter (<http://en.wikipedia.org/wiki/Shutter_%28software%29>) keeps its plugins on your computer.
 On my computer, it's in `/usr/share/shutter/resources/system/upload_plugins/upload`.

lib/Lutim.pm

@@ -128,7 +128,20 @@ sub startup {
 
     $self->hook(
         before_dispatch => sub {
-            shift->stop_upload();
+            my $c = shift;
+            $c->stop_upload();
+            if (defined($c->config->{allowed_domains})) {
+                if ($c->config->{allowed_domains}->[0] eq '*') {
+                    $c->res->headers->header('Access-Control-Allow-Origin' => '*');
+                } elsif (my $origin = $c->req->headers->origin) {
+                    for my $domain ($c->config->{allowed_domains}) {
+                        if ($domain->[0] eq $origin) {
+                            $c->res->headers->header('Access-Control-Allow-Origin' => $origin);
+                            last;
+                        }
+                    }
+                }
+            }
         }
     );
 
@@ -146,6 +159,12 @@ sub startup {
     # Router
     my $r = $self->routes;
 
+    $r->options(sub {
+        my $c = shift;
+        $c->res->headers->allow('POST');
+        $c->render(data => '', status => 204);
+    });
+
     $r->get('/' => sub {
             my $c = shift;
 

lutim.conf.template

@@ -21,4 +21,5 @@
     #max_total_size    => 10*1024*1024*1024, # optional, maximum total size of the files directory (used with script/lutim cron watch)
     #policy_when_full  => 'warn', # optional, policy when files directory is over max_total_size. Valid values are 'warn', 'stop-upload' and 'delete'. See README.
     #broadcast_message => 'Maintenance', #optional, the broadcast_message is displayed on all pages of LUTIm (but no in json response)
+    #allowed_domains   => ['http://1.example.com', 'http://2.example.com'], #optional, array of authorized domains for API calls. If you want to authorize everyone to use the API: ['*']
 };