feat: add configurable transport-independent CORS policy

config/config.go

@@ -5,6 +5,7 @@ import (
 	"time"
 
 	"git.yuntuo.hk/k2safe/go-omni/contract"
+	"git.yuntuo.hk/k2safe/go-omni/cors"
 	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
 	"git.yuntuo.hk/k2safe/go-omni/httpx"
 	"git.yuntuo.hk/k2safe/go-omni/lifecycle"
@@ -28,6 +29,7 @@ type TLSConfig struct {
 
 // Config controls the default runtime behavior of an App.
 type Config struct {
+	CORS                 cors.Config              `json:"cors"`
 	Request              contract.RequestPolicy   `json:"request"`
 	Address              string                   `json:"address"`
 	Transport            string                   `json:"transport"`
@@ -61,6 +63,9 @@ func Default() Config {
 
 // Validate checks configuration values before an application starts.
 func (c Config) Validate() error {
+	if err := c.CORS.Validate(); err != nil {
+		return AtField("cors", err)
+	}
 	if err := c.Lifecycle.Validate(); err != nil {
 		return AtField("lifecycle", err)
 	}
@@ -188,12 +193,14 @@ func WithTrustedProxies(proxies ...string) Option {
 // WithConfig applies a complete configuration loaded from a file or
 // environment. Later options can still override individual fields.
 func WithConfig(settings Config) Option {
+	settings.CORS = settings.CORS.Clone()
 	settings.Response = settings.Response.Clone()
 	settings.Errors = settings.Errors.Clone()
 	settings.TrustedProxies = append([]string(nil), settings.TrustedProxies...)
 	settings.Log.RedactKeys = append([]string(nil), settings.Log.RedactKeys...)
 	return func(cfg *Config) {
 		*cfg = settings
+		cfg.CORS = settings.CORS.Clone()
 		cfg.Response = settings.Response.Clone()
 		cfg.Errors = settings.Errors.Clone()
 		cfg.TrustedProxies = append([]string(nil), settings.TrustedProxies...)
@@ -201,6 +208,12 @@ func WithConfig(settings Config) Option {
 	}
 }
 
+// WithCORS installs an app-local CORS policy, before routing and authentication.
+func WithCORS(settings cors.Config) Option {
+	settings = settings.Clone()
+	return func(cfg *Config) { cfg.CORS = settings.Clone() }
+}
+
 // WithResponse configures this application's default JSON envelope.
 func WithResponse(settings response.Config) Option {
 	settings = settings.Clone()