feat(web): move CORSOrigins to server.Config; web.New warns on empty CORS; align to v1.2.0

2026-08-08 02:24:08 -06:00
parent fc3fe750d4
commit c611e67946
8 changed files with 94 additions and 24 deletions
@@ -11,6 +11,12 @@ type Config struct {
 	WriteTimeout    time.Duration `env:"EINHERJAR_SERVER_WRITE_TIMEOUT"    envDefault:"10s"`
 	IdleTimeout     time.Duration `env:"EINHERJAR_SERVER_IDLE_TIMEOUT"     envDefault:"120s"`
 	ShutdownTimeout time.Duration `env:"EINHERJAR_SERVER_SHUTDOWN_TIMEOUT" envDefault:"10s"`
+
+	// CORSOrigins is the allowed cross-origin list (comma-separated in the env var).
+	// web.New applies mw.CORS with it automatically; callers of server.New pass it to
+	// mw.CORS themselves. "*" is rejected by mw.CORS — use mw.CORSAllowAll for allow-all
+	// (development only).
+	CORSOrigins []string `env:"EINHERJAR_SERVER_CORS_ORIGINS" envSeparator:","`
 }

 const defaultShutdownTimeout = 10 * time.Second