feat: add configurable transport-independent CORS policy

config/cors_test.go

@@ -0,0 +1,51 @@
+package config_test
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"git.yuntuo.hk/k2safe/go-omni/config"
+)
+
+type corsProject struct {
+	Server config.Config `json:"server"`
+}
+
+func (c corsProject) Validate() error { return config.AtField("server", c.Server.Validate()) }
+
+func TestCORSConfiguration(t *testing.T) {
+	t.Setenv("WEB_ORIGIN", "https://web.example")
+	for ext, source := range map[string]string{
+		"yaml": "server:\n  cors:\n    enabled: true\n    allowedOrigins:\n      - '${WEB_ORIGIN}'\n    allowedMethods: [GET, POST]\n    allowedHeaders: [Authorization, Content-Type]\n    maxAge: 10m\n",
+		"json": `{"server":{"cors":{"enabled":true,"allowedOrigins":["${WEB_ORIGIN}"],"allowedMethods":["GET","POST"],"allowedHeaders":["Authorization","Content-Type"],"maxAge":"10m"}}}`,
+		"xml":  `<config><server><cors><enabled type="bool">true</enabled><allowedOrigins type="array"><item>${WEB_ORIGIN}</item></allowedOrigins><allowedMethods type="array"><item>GET</item><item>POST</item></allowedMethods><allowedHeaders type="array"><item>Authorization</item><item>Content-Type</item></allowedHeaders><maxAge>10m</maxAge></cors></server></config>`,
+	} {
+		t.Run(ext, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "config."+ext)
+			if err := os.WriteFile(path, []byte(source), 0600); err != nil {
+				t.Fatal(err)
+			}
+			cfg, err := config.LoadProject(path, corsProject{Server: config.Default()})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !cfg.Server.CORS.Enabled || cfg.Server.CORS.AllowedOrigins[0] != "https://web.example" || cfg.Server.CORS.MaxAge != 10*time.Minute {
+				t.Fatal(cfg.Server.CORS)
+			}
+		})
+	}
+	path := filepath.Join(t.TempDir(), "bad.yaml")
+	if err := os.WriteFile(path, []byte("server:\n  cors:\n    enabled: true\n    allowedOrigins:\n      - '${WEB_ORIGIN}'\n"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("WEB_ORIGIN", "https://user:secret@web.example")
+	_, err := config.LoadProject(path, corsProject{Server: config.Default()})
+	var d *config.Error
+	if !errors.As(err, &d) || d.Field != "server.cors.allowedOrigins[0]" || d.Env != "WEB_ORIGIN" || d.Line != 5 || strings.Contains(err.Error(), "secret") {
+		t.Fatal(err)
+	}
+}