clawbot f7cc6b42e0 server: limit wildcard CORS to the public routes (closes #100) ...

The CORS wildcard was global, so it also covered the Basic-Auth
protected /metrics, which REPO_POLICIES.md forbids, and it allowed
POST, PUT and DELETE, which no route serves, plus the Authorization
and X-CSRF-Token headers. CORS now sits on a router holding only the
public routes and allows GET and OPTIONS with the Accept and
Content-Type headers. /metrics gets no CORS at all.

Both are mounted routers rather than a Group: chi answers OPTIONS on
a Group's route with 405 before its middleware runs, and any method
/metrics does not register would otherwise fall through to the public
router. So every method on /metrics now meets Basic Auth first, and
/metrics/ is served like /metrics.

Model: opus-5-5

2026-10-01 21:05:43 +02:00

..

export_test.go

server: assert timeouts on the served http.Server, not just the constructor (closes #120)

2026-09-28 22:01:36 +02:00

routes_test.go

server: limit wildcard CORS to the public routes (closes #100)

2026-10-01 21:05:43 +02:00

routes.go

server: limit wildcard CORS to the public routes (closes #100)

2026-10-01 21:05:43 +02:00

server_test.go

server: assert timeouts on the served http.Server, not just the constructor (closes #120)

2026-09-28 22:01:36 +02:00

server.go

server: set all four http.Server socket timeouts (#118)

2026-09-09 15:17:43 +02:00