feat: implement CORS configuration and handling

[PierreLeGuen]

• Added CORS support to the API by introducing a new CorsConfig struct to manage allowed origins and wildcard suffixes.
• Implemented is_origin_allowed function to validate incoming requests against the CORS configuration.
• Integrated CORS layer into the application router to handle preflight requests and specify allowed methods and headers.
• Updated tests to verify CORS functionality, including exact matches, localhost, and wildcard suffixes.
• Modified ApiConfig to include CORS settings, ensuring they can be configured via environment variables.

---

Note

Adds env-driven CorsConfig and enforces CORS via CorsLayer with predicate-based origin checks, plus comprehensive tests.

• CORS Configuration:
  • Introduce config::CorsConfig with exact_matches and wildcard_suffixes; default parses CORS_ALLOWED_ORIGINS (supports *.domain, *-suffix).
  • Extend config::ApiConfig with cors: CorsConfig and update test configs to include it.
• API Integration:
  • Add is_origin_allowed to validate origins (exact matches; http://localhost[:port], http://127.0.0.1[:port]; https:// with allowed suffixes).
  • Wire tower_http::cors::CorsLayer using AllowOrigin::predicate in build_app_with_config; allow and expose Any methods/headers.
• Tests:
  • Add parsing tests for CorsConfig variants and whitespace/empty entries.
  • Add CORS behavior tests for exact matches, localhost/127.0.0.1, and HTTPS wildcard suffixes.

^{Written by Cursor Bugbot for commit d8bca65. This will update automatically on new commits. Configure here.}

[cursor]

This is the final PR Bugbot will review for you during this billing cycle

Your free Bugbot reviews will reset on January 9

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Bug: Localhost CORS bypass is hardcoded and cannot be disabled

The is_origin_allowed function unconditionally allows http://localhost and http://127.0.0.1 origins regardless of the CorsConfig settings. This means in production environments, any local web server can make CORS requests to the API, which could be exploited by malware or malicious local processes. This bypass cannot be disabled through configuration, making it impossible to secure the API against local origin attacks in production.

 

[nickpismenkov]

LGTM