fix(mcp): CORS-aware scaffold, cors.wildcard rule, server-not-appended FP; v1.1.2

internal/rules/cors_rules_test.go

@@ -0,0 +1,58 @@
+package rules
+
+import "testing"
+
+const corsWildcardSnippet = `package wire
+
+import "code.nochebuena.dev/einherjar/web/mw"
+
+func f() { _ = mw.CORS([]string{"*"}) }
+`
+
+const serverAppendedSnippet = `package wire
+
+import (
+	"code.nochebuena.dev/einherjar/core/launcher"
+	"code.nochebuena.dev/einherjar/web/server"
+)
+
+func f() {
+	srv := server.New(logger, cfg)
+	lc := launcher.New(logger)
+	lc.Append(srv)
+}
+`
+
+const serverNotAppendedSnippet = `package wire
+
+import (
+	"code.nochebuena.dev/einherjar/core/launcher"
+	"code.nochebuena.dev/einherjar/web/server"
+)
+
+func f() {
+	srv := server.New(logger, cfg)
+	lc := launcher.New(logger)
+	_ = srv
+	_ = lc
+}
+`
+
+func TestCORSWildcardFires(t *testing.T) {
+	got := findingsFor(Run(corsWildcardSnippet), "cors.wildcard-noop")
+	if len(got) == 0 {
+		t.Fatal("cors.wildcard-noop did not fire on mw.CORS([]string{\"*\"})")
+	}
+}
+
+func TestServerAppendedNoFalsePositive(t *testing.T) {
+	if got := findingsFor(Run(serverAppendedSnippet), "web.server-not-appended"); len(got) != 0 {
+		t.Errorf("web.server-not-appended false-positived on an appended server: %+v", got)
+	}
+}
+
+func TestServerNotAppendedFires(t *testing.T) {
+	if got := findingsFor(Run(serverNotAppendedSnippet), "web.server-not-appended"); len(got) == 0 {
+		t.Error("web.server-not-appended should fire when server.New is not appended")
+	}
+}