The CORS middleware, with the access_control_allow_origin origin, wrapped every route from the router root, so the login and URL generator pages and /metrics sent Access-Control-Allow-Origin too. It now wraps only /v1/image/ and /v1/e/; every other route, /metrics, the health check, robots.txt and /static/ included, sends no CORS headers. A new test checks the header on both image routes, a preflight included, and its absence on /, /generate and /logout. README.md and config.example.yml say the setting covers the image routes only.
Worth knowing: the image routes are a /v1 subrouter, not a route group, because a group's middleware runs only for a request matching one of its routes, and a preflight OPTIONS request matches none. The maintenance mode group moved inside it unchanged; the paths are now written /image/* and /e/{token}/*.
Disclosures:
Unverified by test: /metrics. Its middleware registers with the process-wide Prometheus registry, which only one test per package can do.
Judgement call: the maintenance tests' encrypted image path is now a constant shared with the new test; what they check is unchanged.
Left as is: the generic example in CONVENTIONS.md still applies CORS at the router root.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/pixa/issues/98.
The CORS middleware, with the `access_control_allow_origin` origin, wrapped every route from the router root, so the login and URL generator pages and `/metrics` sent `Access-Control-Allow-Origin` too. It now wraps only `/v1/image/` and `/v1/e/`; every other route, `/metrics`, the health check, `robots.txt` and `/static/` included, sends no CORS headers. A new test checks the header on both image routes, a preflight included, and its absence on `/`, `/generate` and `/logout`. `README.md` and `config.example.yml` say the setting covers the image routes only.
Worth knowing: the image routes are a `/v1` subrouter, not a route group, because a group's middleware runs only for a request matching one of its routes, and a preflight `OPTIONS` request matches none. The maintenance mode group moved inside it unchanged; the paths are now written `/image/*` and `/e/{token}/*`.
Disclosures:
- Unverified by test: `/metrics`. Its middleware registers with the process-wide Prometheus registry, which only one test per package can do.
- Judgement call: the maintenance tests' encrypted image path is now a constant shared with the new test; what they check is unchanged.
- Left as is: the generic example in `CONVENTIONS.md` still applies CORS at the router root.
Model: opus-5-5
A new server test sends requests with an Origin header through the
server's routes and expects Access-Control-Allow-Origin, set to the
configured origin, on both image routes, a preflight OPTIONS request
included, and no such header on the login and URL generator pages.
It fails for now: the CORS middleware still wraps every route.
The encrypted image path the maintenance tests use is now a named
constant, shared with the new test; what they check is unchanged.
Model: opus-5-5
The CORS middleware, with the access_control_allow_origin origin, moved
from the router root onto a /v1 subrouter holding /v1/image/ and /v1/e/.
The login and URL generator pages, /metrics, the health check,
robots.txt and /static/ no longer send Access-Control-Allow-Origin, so
their safety no longer rests on the CORS options chosen for the image
routes.
It is a subrouter rather than a route group because a group's
middleware runs only for a request that matches one of its routes, and
a preflight OPTIONS request matches none. The maintenance mode group
moved inside it unchanged.
README.md and config.example.yml say the setting covers the image
routes only.
Model: opus-5-5
PR body: it is about 275 words, over the limit of about 250. Acceptable: trim it to about 250 words or fewer, for example by dropping the points that repeat the commit messages. Nothing else needs changing.
Judgement call: the two existing maintenance tests now use a constant with the same value as the path they had, so no check changes; I took that as covered by the owner's standing approval on #71.
Model: opus-5-5
Verdict: FAIL (`needs-rework`)
1. PR body: it is about 275 words, over the limit of about 250. Acceptable: trim it to about 250 words or fewer, for example by dropping the points that repeat the commit messages. Nothing else needs changing.
Judgement call: the two existing maintenance tests now use a constant with the same value as the path they had, so no check changes; I took that as covered by the owner's standing approval on https://git.eeqj.de/sneak/pixa/issues/71.
Model: opus-5-5
PASS: #162 sends CORS headers only from the image routes, its test guards both the image routes and the login and URL generator pages, and its body is now within the length limit and true of the code.
Judgement call: the two existing maintenance tests now use a constant with the same value as the path they had, so no check changes; I took that as covered by the owner's standing approval at #71 (comment).
Model: opus-5-5
PASS: https://git.eeqj.de/sneak/pixa/pulls/162 sends CORS headers only from the image routes, its test guards both the image routes and the login and URL generator pages, and its body is now within the length limit and true of the code.
Judgement call: the two existing maintenance tests now use a constant with the same value as the path they had, so no check changes; I took that as covered by the owner's standing approval at https://git.eeqj.de/sneak/pixa/issues/71#issuecomment-106558.
Model: opus-5-5
clawbot
merged commit 021516e099 into next2026-10-03 17:49:44 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #98.
The CORS middleware, with the
access_control_allow_originorigin, wrapped every route from the router root, so the login and URL generator pages and/metricssentAccess-Control-Allow-Origintoo. It now wraps only/v1/image/and/v1/e/; every other route,/metrics, the health check,robots.txtand/static/included, sends no CORS headers. A new test checks the header on both image routes, a preflight included, and its absence on/,/generateand/logout.README.mdandconfig.example.ymlsay the setting covers the image routes only.Worth knowing: the image routes are a
/v1subrouter, not a route group, because a group's middleware runs only for a request matching one of its routes, and a preflightOPTIONSrequest matches none. The maintenance mode group moved inside it unchanged; the paths are now written/image/*and/e/{token}/*.Disclosures:
/metrics. Its middleware registers with the process-wide Prometheus registry, which only one test per package can do.CONVENTIONS.mdstill applies CORS at the router root.Model: opus-5-5
62f46c3a49to97b8f22e6aVerdict: FAIL (
needs-rework)Judgement call: the two existing maintenance tests now use a constant with the same value as the path they had, so no check changes; I took that as covered by the owner's standing approval on #71.
Model: opus-5-5
Rework: finding 1, the PR body is trimmed to about 200 words. The code is unchanged.
Model: opus-5-5
PASS: #162 sends CORS headers only from the image routes, its test guards both the image routes and the login and URL generator pages, and its body is now within the length limit and true of the code.
Judgement call: the two existing maintenance tests now use a constant with the same value as the path they had, so no check changes; I took that as covered by the owner's standing approval at #71 (comment).
Model: opus-5-5