feat(web)!: remove web.Config.AllowedOrigins; CORS lives only on server.Config.CORSOrigins (v1.3.0)

2026-08-08 10:48:00 -06:00
parent c611e67946
commit 929fafcfa5
6 changed files with 46 additions and 24 deletions
@@ -1,6 +1,6 @@
 # einherjar/web

-[![version](https://img.shields.io/badge/version-v1.2.0-5C4EE5?style=flat-square)](https://code.nochebuena.dev/einherjar/web)
+[![version](https://img.shields.io/badge/version-v1.3.0-5C4EE5?style=flat-square)](https://code.nochebuena.dev/einherjar/web)
 [![license](https://img.shields.io/badge/license-AGPL--3.0-22863A?style=flat-square)](LICENSE)
 [![go](https://img.shields.io/badge/Go-1.26+-00ADD8?style=flat-square&logo=go&logoColor=white)](https://go.dev)

@@ -57,12 +57,16 @@ lc.BeforeStart(func() error {
 lc.Run()
 ```

-With origins (CORS auto-applied):
+With origins set in code (CORS auto-applied). `Server.CORSOrigins` is the single
+source of truth — normally it loads from `EINHERJAR_SERVER_CORS_ORIGINS`, but you
+can set it directly to override without the env var:

 ```go
 srv := web.New(logger, web.Config{
-    Server:         server.Config{Port: 9090},
-    AllowedOrigins: []string{"https://example.com"},
+    Server: server.Config{
+        Port:        9090,
+        CORSOrigins: []string{"https://example.com"},
+    },
 })
 ```