diff --git a/CHANGELOG.md b/CHANGELOG.md index bc4e5b6..5bc27a6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,29 @@ This module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html --- +## [1.3.0] — 2026-08-08 + +Minor release carrying a **breaking API change** to CORS configuration. The framework is +private with controlled consumers, so this ships in the 1.x line with a loud compile break +instead of a v2 module-path (`/v2`) migration. + +### Removed + +- **⚠️ BREAKING: `web.Config.AllowedOrigins` removed.** CORS origins now have a single + home: `server.Config.CORSOrigins` (env `EINHERJAR_SERVER_CORS_ORIGINS`). The field was + env-backed through v1.1.x and a code-only override in v1.2.0 — reading it after the env + tag moved silently served *no* CORS. Removing it turns that runtime trap into a compile + error. + + **Migration:** replace `cfg.Web.AllowedOrigins` with `cfg.Server.CORSOrigins`, and + `web.Config{AllowedOrigins: o}` with `web.Config{Server: server.Config{CORSOrigins: o}}` + — or just let `web.New` read `EINHERJAR_SERVER_CORS_ORIGINS`. The MCP flags any leftover + reference (`validate_snippet` rule `web.allowedorigins-removed`). + +### Changed + +- Bumped `contracts`, `core` to v1.3.0. + ## [1.2.0] — 2026-08-08 Minor — CORS configuration moved to its rightful struct; `web.New` made safe-by-default. diff --git a/README.md b/README.md index fde656e..cda66ee 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # einherjar/web -[![version](https://img.shields.io/badge/version-v1.2.0-5C4EE5?style=flat-square)](https://code.nochebuena.dev/einherjar/web) +[![version](https://img.shields.io/badge/version-v1.3.0-5C4EE5?style=flat-square)](https://code.nochebuena.dev/einherjar/web) [![license](https://img.shields.io/badge/license-AGPL--3.0-22863A?style=flat-square)](LICENSE) [![go](https://img.shields.io/badge/Go-1.26+-00ADD8?style=flat-square&logo=go&logoColor=white)](https://go.dev) @@ -57,12 +57,16 @@ lc.BeforeStart(func() error { lc.Run() ``` -With origins (CORS auto-applied): +With origins set in code (CORS auto-applied). `Server.CORSOrigins` is the single +source of truth — normally it loads from `EINHERJAR_SERVER_CORS_ORIGINS`, but you +can set it directly to override without the env var: ```go srv := web.New(logger, web.Config{ - Server: server.Config{Port: 9090}, - AllowedOrigins: []string{"https://example.com"}, + Server: server.Config{ + Port: 9090, + CORSOrigins: []string{"https://example.com"}, + }, }) ``` diff --git a/go.mod b/go.mod index a2d4f95..0da6075 100644 --- a/go.mod +++ b/go.mod @@ -3,8 +3,8 @@ module code.nochebuena.dev/einherjar/web go 1.26 require ( - code.nochebuena.dev/einherjar/contracts v1.2.0 - code.nochebuena.dev/einherjar/core v1.2.0 + code.nochebuena.dev/einherjar/contracts v1.3.0 + code.nochebuena.dev/einherjar/core v1.3.0 github.com/go-chi/chi/v5 v5.2.1 github.com/google/uuid v1.6.0 golang.org/x/time v0.11.0 diff --git a/go.sum b/go.sum index e58b8a0..b7b7f66 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,7 @@ -code.nochebuena.dev/einherjar/contracts v1.2.0 h1:i1qschvttqXJTd7yaFmHkvtj4weGfTcTkj8q9sG6pRI= -code.nochebuena.dev/einherjar/contracts v1.2.0/go.mod h1:ccltUtrFb5+MEJdkx2VVEUL+xC5pupVlVVsMM8AlCWI= -code.nochebuena.dev/einherjar/core v1.2.0 h1:nomXS05rqY9bOwnXhLbCIK/K8/KW3WbLOMp4gR8ho/4= -code.nochebuena.dev/einherjar/core v1.2.0/go.mod h1:L5PNjnuNN7vz057egI5y3r8DIGr7ZrbACFU19jgWoWY= +code.nochebuena.dev/einherjar/contracts v1.3.0 h1:rm5hqaA1NBtWgH8okwwt6WLoIne1SwQ1Ogi7qbbwfY8= +code.nochebuena.dev/einherjar/contracts v1.3.0/go.mod h1:ccltUtrFb5+MEJdkx2VVEUL+xC5pupVlVVsMM8AlCWI= +code.nochebuena.dev/einherjar/core v1.3.0 h1:LRT8gln+KJLLGzySVf3C0WX/qiufxg5Jp5v2jySBirE= +code.nochebuena.dev/einherjar/core v1.3.0/go.mod h1:2Pdbb3Pni8dYBZKOpQKqzpR/WFq+Ln9+KSPycf7DQh0= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw= diff --git a/mw/cors.go b/mw/cors.go index 216bbf9..63c5cb3 100644 --- a/mw/cors.go +++ b/mw/cors.go @@ -19,7 +19,7 @@ const ( // if strings.EqualFold(cfg.AppEnv, "local") { // corsMW = mw.CORSAllowAll() // dev: any origin // } else { -// corsMW = mw.CORS(cfg.AllowedOrigins) // prod: explicit origins +// corsMW = mw.CORS(cfg.CORSOrigins) // prod: explicit origins // } func CORS(origins []string) func(http.Handler) http.Handler { // "*" would be a silent no-op (exact-match only) — reject it loudly so a diff --git a/web.go b/web.go index ed470ed..012b12f 100644 --- a/web.go +++ b/web.go @@ -11,20 +11,19 @@ import ( ) // Config aggregates configuration for the web module. Server holds the HTTP server -// settings, including CORS origins (Server.CORSOrigins, loaded from -// EINHERJAR_SERVER_CORS_ORIGINS). AllowedOrigins is a programmatic-only override — -// set it in code to override Server.CORSOrigins; leave it nil to use the env value. +// settings, including the single source of truth for CORS: Server.CORSOrigins, +// loaded from EINHERJAR_SERVER_CORS_ORIGINS. To override origins from code (without +// the env var), set Server.CORSOrigins directly before calling New. type Config struct { - Server server.Config - AllowedOrigins []string // code-only override of Server.CORSOrigins (no env tag) + Server server.Config } // New creates a [server.Server] with the recommended middleware stack pre-applied: // 1. Recover — catches panics, returns 500 // 2. RequestID — injects UUID v7 request ID (falls back to v4) // 3. RequestLogger — logs method, path, status, latency -// 4. CORS — applied only when origins are configured (Server.CORSOrigins from -// EINHERJAR_SERVER_CORS_ORIGINS, or the AllowedOrigins code override) +// 4. CORS — applied only when Server.CORSOrigins is non-empty (from +// EINHERJAR_SERVER_CORS_ORIGINS, or set in code before calling New) // // web.New uses explicit origins only; it does NOT support allow-all. For // [mw.CORSAllowAll] (development) or any custom middleware order, use [server.New] @@ -40,12 +39,8 @@ func New(logger logging.Logger, cfg ...Config) server.Server { mw.RequestID(newRequestID), mw.RequestLogger(logger), } - origins := c.Server.CORSOrigins - if len(c.AllowedOrigins) > 0 { - origins = c.AllowedOrigins - } - if len(origins) > 0 { - middleware = append(middleware, mw.CORS(origins)) + if len(c.Server.CORSOrigins) > 0 { + middleware = append(middleware, mw.CORS(c.Server.CORSOrigins)) } else { logger.Info("web.New: no CORS origins configured (EINHERJAR_SERVER_CORS_ORIGINS) — cross-origin browser requests will be blocked") }