feat(web)!: remove web.Config.AllowedOrigins; CORS lives only on server.Config.CORSOrigins (v1.3.0)

web.go

@@ -11,20 +11,19 @@ import (
 )
 
 // Config aggregates configuration for the web module. Server holds the HTTP server
-// settings, including CORS origins (Server.CORSOrigins, loaded from
-// EINHERJAR_SERVER_CORS_ORIGINS). AllowedOrigins is a programmatic-only override —
-// set it in code to override Server.CORSOrigins; leave it nil to use the env value.
+// settings, including the single source of truth for CORS: Server.CORSOrigins,
+// loaded from EINHERJAR_SERVER_CORS_ORIGINS. To override origins from code (without
+// the env var), set Server.CORSOrigins directly before calling New.
 type Config struct {
-	Server         server.Config
-	AllowedOrigins []string // code-only override of Server.CORSOrigins (no env tag)
+	Server server.Config
 }
 
 // New creates a [server.Server] with the recommended middleware stack pre-applied:
 //  1. Recover — catches panics, returns 500
 //  2. RequestID — injects UUID v7 request ID (falls back to v4)
 //  3. RequestLogger — logs method, path, status, latency
-//  4. CORS — applied only when origins are configured (Server.CORSOrigins from
-//     EINHERJAR_SERVER_CORS_ORIGINS, or the AllowedOrigins code override)
+//  4. CORS — applied only when Server.CORSOrigins is non-empty (from
+//     EINHERJAR_SERVER_CORS_ORIGINS, or set in code before calling New)
 //
 // web.New uses explicit origins only; it does NOT support allow-all. For
 // [mw.CORSAllowAll] (development) or any custom middleware order, use [server.New]
@@ -40,12 +39,8 @@ func New(logger logging.Logger, cfg ...Config) server.Server {
 		mw.RequestID(newRequestID),
 		mw.RequestLogger(logger),
 	}
-	origins := c.Server.CORSOrigins
-	if len(c.AllowedOrigins) > 0 {
-		origins = c.AllowedOrigins
-	}
-	if len(origins) > 0 {
-		middleware = append(middleware, mw.CORS(origins))
+	if len(c.Server.CORSOrigins) > 0 {
+		middleware = append(middleware, mw.CORS(c.Server.CORSOrigins))
 	} else {
 		logger.Info("web.New: no CORS origins configured (EINHERJAR_SERVER_CORS_ORIGINS) — cross-origin browser requests will be blocked")
 	}