feat(web)!: remove web.Config.AllowedOrigins; CORS lives only on server.Config.CORSOrigins (v1.3.0)

CHANGELOG.md

@@ -6,6 +6,29 @@ This module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html
 
 ---
 
+## [1.3.0] — 2026-08-08
+
+Minor release carrying a **breaking API change** to CORS configuration. The framework is
+private with controlled consumers, so this ships in the 1.x line with a loud compile break
+instead of a v2 module-path (`/v2`) migration.
+
+### Removed
+
+- **⚠️ BREAKING: `web.Config.AllowedOrigins` removed.** CORS origins now have a single
+  home: `server.Config.CORSOrigins` (env `EINHERJAR_SERVER_CORS_ORIGINS`). The field was
+  env-backed through v1.1.x and a code-only override in v1.2.0 — reading it after the env
+  tag moved silently served *no* CORS. Removing it turns that runtime trap into a compile
+  error.
+
+  **Migration:** replace `cfg.Web.AllowedOrigins` with `cfg.Server.CORSOrigins`, and
+  `web.Config{AllowedOrigins: o}` with `web.Config{Server: server.Config{CORSOrigins: o}}`
+  — or just let `web.New` read `EINHERJAR_SERVER_CORS_ORIGINS`. The MCP flags any leftover
+  reference (`validate_snippet` rule `web.allowedorigins-removed`).
+
+### Changed
+
+- Bumped `contracts`, `core` to v1.3.0.
+
 ## [1.2.0] — 2026-08-08
 
 Minor — CORS configuration moved to its rightful struct; `web.New` made safe-by-default.

README.md

@@ -1,6 +1,6 @@
 # einherjar/web
 
-[![version](https://img.shields.io/badge/version-v1.2.0-5C4EE5?style=flat-square)](https://code.nochebuena.dev/einherjar/web)
+[![version](https://img.shields.io/badge/version-v1.3.0-5C4EE5?style=flat-square)](https://code.nochebuena.dev/einherjar/web)
 [![license](https://img.shields.io/badge/license-AGPL--3.0-22863A?style=flat-square)](LICENSE)
 [![go](https://img.shields.io/badge/Go-1.26+-00ADD8?style=flat-square&logo=go&logoColor=white)](https://go.dev)
 
@@ -57,12 +57,16 @@ lc.BeforeStart(func() error {
 lc.Run()
 ```
 
-With origins (CORS auto-applied):
+With origins set in code (CORS auto-applied). `Server.CORSOrigins` is the single
+source of truth — normally it loads from `EINHERJAR_SERVER_CORS_ORIGINS`, but you
+can set it directly to override without the env var:
 
 ```go
 srv := web.New(logger, web.Config{
-    Server:         server.Config{Port: 9090},
-    AllowedOrigins: []string{"https://example.com"},
+    Server: server.Config{
+        Port:        9090,
+        CORSOrigins: []string{"https://example.com"},
+    },
 })
 ```
 

go.mod

@@ -3,8 +3,8 @@ module code.nochebuena.dev/einherjar/web
 go 1.26
 
 require (
-	code.nochebuena.dev/einherjar/contracts v1.2.0
-	code.nochebuena.dev/einherjar/core v1.2.0
+	code.nochebuena.dev/einherjar/contracts v1.3.0
+	code.nochebuena.dev/einherjar/core v1.3.0
 	github.com/go-chi/chi/v5 v5.2.1
 	github.com/google/uuid v1.6.0
 	golang.org/x/time v0.11.0

go.sum

@@ -1,7 +1,7 @@
-code.nochebuena.dev/einherjar/contracts v1.2.0 h1:i1qschvttqXJTd7yaFmHkvtj4weGfTcTkj8q9sG6pRI=
-code.nochebuena.dev/einherjar/contracts v1.2.0/go.mod h1:ccltUtrFb5+MEJdkx2VVEUL+xC5pupVlVVsMM8AlCWI=
-code.nochebuena.dev/einherjar/core v1.2.0 h1:nomXS05rqY9bOwnXhLbCIK/K8/KW3WbLOMp4gR8ho/4=
-code.nochebuena.dev/einherjar/core v1.2.0/go.mod h1:L5PNjnuNN7vz057egI5y3r8DIGr7ZrbACFU19jgWoWY=
+code.nochebuena.dev/einherjar/contracts v1.3.0 h1:rm5hqaA1NBtWgH8okwwt6WLoIne1SwQ1Ogi7qbbwfY8=
+code.nochebuena.dev/einherjar/contracts v1.3.0/go.mod h1:ccltUtrFb5+MEJdkx2VVEUL+xC5pupVlVVsMM8AlCWI=
+code.nochebuena.dev/einherjar/core v1.3.0 h1:LRT8gln+KJLLGzySVf3C0WX/qiufxg5Jp5v2jySBirE=
+code.nochebuena.dev/einherjar/core v1.3.0/go.mod h1:2Pdbb3Pni8dYBZKOpQKqzpR/WFq+Ln9+KSPycf7DQh0=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=

mw/cors.go

@@ -19,7 +19,7 @@ const (
 //	if strings.EqualFold(cfg.AppEnv, "local") {
 //	    corsMW = mw.CORSAllowAll()            // dev: any origin
 //	} else {
-//	    corsMW = mw.CORS(cfg.AllowedOrigins)  // prod: explicit origins
+//	    corsMW = mw.CORS(cfg.CORSOrigins)     // prod: explicit origins
 //	}
 func CORS(origins []string) func(http.Handler) http.Handler {
 	// "*" would be a silent no-op (exact-match only) — reject it loudly so a

web.go

@@ -11,20 +11,19 @@ import (
 )
 
 // Config aggregates configuration for the web module. Server holds the HTTP server
-// settings, including CORS origins (Server.CORSOrigins, loaded from
-// EINHERJAR_SERVER_CORS_ORIGINS). AllowedOrigins is a programmatic-only override —
-// set it in code to override Server.CORSOrigins; leave it nil to use the env value.
+// settings, including the single source of truth for CORS: Server.CORSOrigins,
+// loaded from EINHERJAR_SERVER_CORS_ORIGINS. To override origins from code (without
+// the env var), set Server.CORSOrigins directly before calling New.
 type Config struct {
 	Server server.Config
-	AllowedOrigins []string // code-only override of Server.CORSOrigins (no env tag)
 }
 
 // New creates a [server.Server] with the recommended middleware stack pre-applied:
 //  1. Recover — catches panics, returns 500
 //  2. RequestID — injects UUID v7 request ID (falls back to v4)
 //  3. RequestLogger — logs method, path, status, latency
-//  4. CORS — applied only when origins are configured (Server.CORSOrigins from
-//     EINHERJAR_SERVER_CORS_ORIGINS, or the AllowedOrigins code override)
+//  4. CORS — applied only when Server.CORSOrigins is non-empty (from
+//     EINHERJAR_SERVER_CORS_ORIGINS, or set in code before calling New)
 //
 // web.New uses explicit origins only; it does NOT support allow-all. For
 // [mw.CORSAllowAll] (development) or any custom middleware order, use [server.New]
@@ -40,12 +39,8 @@ func New(logger logging.Logger, cfg ...Config) server.Server {
 		mw.RequestID(newRequestID),
 		mw.RequestLogger(logger),
 	}
-	origins := c.Server.CORSOrigins
-	if len(c.AllowedOrigins) > 0 {
-		origins = c.AllowedOrigins
-	}
-	if len(origins) > 0 {
-		middleware = append(middleware, mw.CORS(origins))
+	if len(c.Server.CORSOrigins) > 0 {
+		middleware = append(middleware, mw.CORS(c.Server.CORSOrigins))
 	} else {
 		logger.Info("web.New: no CORS origins configured (EINHERJAR_SERVER_CORS_ORIGINS) — cross-origin browser requests will be blocked")
 	}