From b29499bf319da5ea846d62485e8a5529890663d4 Mon Sep 17 00:00:00 2001
From: Danny Kopping <danny@coder.com>
Date: Mon, 25 Nov 2024 04:29:12 +0000
Subject: [PATCH 1/3] Support CORS behaviour

Signed-off-by: Danny Kopping <danny@coder.com>
---
 provider/app.go | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/provider/app.go b/provider/app.go
index 3fd71692..60037e55 100644
--- a/provider/app.go
+++ b/provider/app.go
@@ -162,6 +162,25 @@ func appResource() *schema.Resource {
 					return diag.Errorf("invalid app share %q, must be one of \"owner\", \"authenticated\", \"public\"", valStr)
 				},
 			},
+			"cors_behavior": {
+				Type:     schema.TypeString,
+				Default:  "simple",
+				ForceNew: true,
+				Optional: true,
+				ValidateDiagFunc: func(val interface{}, c cty.Path) diag.Diagnostics {
+					valStr, ok := val.(string)
+					if !ok {
+						return diag.Errorf("expected string, got %T", val)
+					}
+
+					switch valStr {
+					case "simple", "passthru":
+						return nil
+					}
+
+					return diag.Errorf("invalid app CORS behavior %q, must be one of \"simple\", \"passthru\"", valStr)
+				},
+			},
 			"url": {
 				Type: schema.TypeString,
 				Description: "An external url if `external=true` or a URL to be proxied to from inside the workspace. " +

From ed534d7c8176634c92caa6a6520b93f4d44d9db7 Mon Sep 17 00:00:00 2001
From: Danny Kopping <danny@coder.com>
Date: Tue, 26 Nov 2024 14:17:45 +0000
Subject: [PATCH 2/3] Tests

Signed-off-by: Danny Kopping <danny@coder.com>
---
 provider/app_test.go | 59 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/provider/app_test.go b/provider/app_test.go
index 6a17ca0c..8e9b6941 100644
--- a/provider/app_test.go
+++ b/provider/app_test.go
@@ -309,4 +309,63 @@ func TestApp(t *testing.T) {
 		}
 	})
 
+	t.Run("CORS Behavior", func(t *testing.T) {
+		t.Parallel()
+
+		baseConfig := `
+			provider "coder" {}
+			resource "coder_agent" "dev" {
+				os = "linux"
+				arch = "amd64"
+			}
+			resource "coder_app" "test" {
+				agent_id = coder_agent.dev.id
+				slug = "test"
+				display_name = "Testing"
+				url = "https://google.com"
+				external = true
+				%s
+			}`
+
+		cases := []struct {
+			name     string
+			config   string
+			behavior string
+		}{{
+			name:     "Default CORS",
+			config:   fmt.Sprintf(baseConfig, ""),
+			behavior: "simple",
+		}, {
+			name:     "Simple CORS",
+			config:   fmt.Sprintf(baseConfig, "cors_behavior = \"simple\""),
+			behavior: "simple",
+		}, {
+			name:     "Passthru CORS",
+			config:   fmt.Sprintf(baseConfig, "cors_behavior = \"passthru\""),
+			behavior: "passthru",
+		}}
+		for _, tc := range cases {
+			tc := tc
+			t.Run(tc.name, func(t *testing.T) {
+				t.Parallel()
+				resource.Test(t, resource.TestCase{
+					ProviderFactories: coderFactory(),
+					IsUnitTest:        true,
+					Steps: []resource.TestStep{{
+						Config: tc.config,
+						Check: func(state *terraform.State) error {
+							require.Len(t, state.Modules, 1)
+							require.Len(t, state.Modules[0].Resources, 2)
+							resource := state.Modules[0].Resources["coder_app.test"]
+							require.NotNil(t, resource)
+							require.Equal(t, tc.behavior, resource.Primary.Attributes["cors_behavior"])
+							return nil
+						},
+						ExpectError: nil,
+					}},
+				})
+			})
+		}
+	})
+
 }

From 28766a4aea4f36f8c09309c4caa852f5b7188376 Mon Sep 17 00:00:00 2001
From: Danny Kopping <danny@coder.com>
Date: Tue, 26 Nov 2024 14:21:41 +0000
Subject: [PATCH 3/3] make gen

Signed-off-by: Danny Kopping <danny@coder.com>
---
 docs/resources/app.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/resources/app.md b/docs/resources/app.md
index 6b8e99f4..fef7d5a5 100644
--- a/docs/resources/app.md
+++ b/docs/resources/app.md
@@ -60,6 +60,7 @@ resource "coder_app" "vim" {
 ### Optional
 
 - `command` (String) A command to run in a terminal opening this app. In the web, this will open in a new tab. In the CLI, this will SSH and execute the command. Either `command` or `url` may be specified, but not both.
+- `cors_behavior` (String)
 - `display_name` (String) A display name to identify the app. Defaults to the slug.
 - `external` (Boolean) Specifies whether `url` is opened on the client machine instead of proxied through the workspace.
 - `healthcheck` (Block Set, Max: 1) HTTP health checking to determine the application readiness. (see [below for nested schema](#nestedblock--healthcheck))