Upgrade Echo and implement dynamic CORS middleware with Air hot reloading

[rossnelson]

Description & motivation 💭

This PR addresses CORS issues by upgrading Echo and implementing a dynamic CORS middleware system, while also adding Air hot reloading for improved development experience.

The CORS error:

/namespaces/abhinavterraformtest2.temporal-dev/workflows:1 Access to fetch at 'https://abhinavterraformtest2.temporal-dev.web.tmprl-test.cloud/api/v1/namespaces/abhinavterraformtest2.temporal-dev/workflow-count?query=GROUP+BY+ExecutionStatus' from origin 'https://staging.thundergun.io/' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

Key Changes:

• Security Fix: Upgraded Echo from v4.9.1 to v4.13.4, removing vulnerable golang-jwt dependency
• Dynamic CORS: Implemented custom middleware that evaluates CORS configuration at runtime
• Development Enhancement: Added unsafeAllowAllOrigins config option for flexible development environments
• Hot Reloading: Integrated Air for automatic Go server rebuilds during development
• Improved DX: Added verbose mode and comprehensive documentation

Screenshots (if applicable) 📸

Air hot reload and verbose mode:

Design Considerations 🎨

• Custom CORS middleware is performance-optimized with early returns
• Security-first approach with clear warnings about unsafe configurations
• Backward compatibility maintained for existing CORS configurations

Testing 🧪

How was this tested 👻

• Manual testing - Verified CORS behavior in both safe and unsafe modes
• Unit tests added - Comprehensive test suite for CORS middleware
• Air integration tested - Hot reloading works correctly in development

Steps for others to test: 🚶🏽‍♂️🚶🏽‍♀️

1. Test CORS Security:

   • Set unsafeAllowAllOrigins: false and verify only allowed origins work
   • Set unsafeAllowAllOrigins: true and verify any origin is accepted

2. Test Hot Reloading:

   • Run pnpm dev in development mode
   • Modify Go source files and verify automatic rebuilds
   • Use UI_SERVER_VERBOSE=true pnpm dev to see detailed logs

3. Test E2E Mode:

   • Verify e2e environment still uses traditional build process

Checklists

Draft Checklist

• All tests passing
• Documentation updated
• Security considerations addressed

Merge Checklist

• Code reviewed
• CORS security implications understood
• Air configuration verified

Docs

Any docs updates needed?

• Updated server README with CORS configuration documentation
• Added security warnings for unsafe configurations
• Documented Air hot reloading setup
• Added verbose mode documentation

Depends on: https://github.com/temporalio/saas-components/pull/1930

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
holocene	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jun 17, 2025 2:46pm

[andrewzamojc]

Looks pretty good. I left a couple questions.

[andrewzamojc]

LGTM