Add /api/search/autocompletes path

- This path is a wrapper around a call to the search_api_v2 autocomplete endpoint,
  but requires CORS support (and most of the test suite is CORS related) because it's
  currently required to be accessible from all true .gov.uk hosts (including non-prod)
  as well as heroku preview apps.

Audit trail:
https://github.com/alphagov/finder-frontend/blob/ddb7cd2c04a4f3d564cf11fb86393e75678add00/app/controllers/api/autocompletes_controller.rb
https://github.com/alphagov/finder-frontend/blob/ddb7cd2c04a4f3d564cf11fb86393e75678add00/config/routes.rb#L13-L15
https://github.com/alphagov/finder-frontend/blob/ddb7cd2c04a4f3d564cf11fb86393e75678add00/config/initializers/cors.rb
https://github.com/alphagov/finder-frontend/blob/ddb7cd2c04a4f3d564cf11fb86393e75678add00/spec/requests/api/autocomplete_spec.rb

Author: KludgeKML

app/controllers/api/autocompletes_controller.rb

@@ -0,0 +1,16 @@
+module Api
+  class AutocompletesController < ApplicationController
+    def index
+      render json: autocomplete_response
+    end
+
+  private
+
+    def autocomplete_response
+      Services
+        .search_api_v2
+        .autocomplete(params.require(:q))
+        .to_hash
+    end
+  end
+end

config/initializers/cors.rb

@@ -0,0 +1,15 @@
+# Be sure to restart your server when you modify this file.
+
+Rails.application.config.middleware.insert_before 0, Rack::Cors do
+  # Allow the autocomplete API to be accessed from any GOV.UK domain, including non-production ones,
+  # as well as Heroku preview apps. Note that the header is rendered on some arbitrary GOV.UK
+  # subdomains (such as assets.publishing.service.gov.uk for CSV preview pages) so www alone is not
+  # enough, and we may need autocomplete on local dev environments and Heroku preview apps as well.
+  allow do
+    origins %r{(\.gov\.uk|\.herokuapp.com)\z}
+
+    resource "/api/search/autocomplete*",
+             headers: :any,
+             methods: %i[get]
+  end
+end

config/routes.rb

@@ -34,6 +34,10 @@
     scope "/places" do
       get "/:service_slug" => "api/places#show"
     end
+
+    scope "/search" do
+      get "/autocomplete" => "api/autocompletes#index"
+    end
   end
 
   get "/find-local-council" => "find_local_council#index"

spec/requests/autocompletes_api_spec.rb

@@ -0,0 +1,57 @@
+RSpec.describe "Autocomplete API", type: :request do
+  let(:search_api_v2) { instance_double(GdsApi::SearchApiV2, autocomplete: autocomplete_response) }
+
+  let(:suggestions) { %w[blue grey red] }
+  let(:autocomplete_response) { instance_double(GdsApi::Response, to_hash: { suggestions: }) }
+  let(:params) { { q: "loving him was" } }
+
+  before do
+    allow(Services).to receive(:search_api_v2).and_return(search_api_v2)
+  end
+
+  it "returns suggestions from Search API v2" do
+    get "/api/search/autocomplete", params: params
+
+    expect(search_api_v2).to have_received(:autocomplete).with("loving him was")
+    expect(response).to be_successful
+    expect(JSON.parse(response.body)).to eq("suggestions" => suggestions)
+  end
+
+  it "fails if the query parameter is missing" do
+    get "/api/search/autocomplete"
+
+    expect(response).to have_http_status(:bad_request)
+  end
+
+  describe "CORS headers" do
+    %w[
+      https://www.gov.uk
+      http://example.dev.gov.uk
+      https://example.publishing.service.gov.uk
+      https://preview-app-abcd123.herokuapp.com
+    ].each do |allowed_host|
+      it "returns CORS headers for #{allowed_host}" do
+        get "/api/search/autocomplete", params:, headers: { Origin: allowed_host }
+
+        expect(response.headers.to_h).to include({
+          "access-control-allow-origin" => allowed_host,
+          "access-control-allow-methods" => "GET",
+        })
+      end
+    end
+
+    it "returns CORS headers when there is a format extension on the path" do
+      get "/api/search/autocomplete.json", params:, headers: { Origin: "https://www.gov.uk" }
+
+      expect(response.headers)
+        .to include("access-control-allow-origin", "access-control-allow-methods")
+    end
+
+    it "doesn't return CORS headers for an unsupported hosts" do
+      get "/api/search/autocomplete", params:, headers: { Origin: "https://www.gov.uk.non-govuk.com" }
+
+      expect(response.headers)
+        .not_to include("access-control-allow-origin", "access-control-allow-methods")
+    end
+  end
+end