clawbot 021516e099 Send CORS headers only from the image routes (closes #98) ...

The CORS middleware with the `access_control_allow_origin` origin wrapped every route from the router root, so the login and URL generator pages and `/metrics` sent `Access-Control-Allow-Origin` too. It now wraps only `/v1/image/` and `/v1/e/`, which form a `/v1` subrouter so that a browser's preflight `OPTIONS` request still gets its answer; the maintenance mode group moved inside it unchanged. Every other route sends no CORS headers. A new test checks both image routes, a preflight included, and the login and URL generator pages. `README.md` and `config.example.yml` say the setting covers the image routes only.

Unverified by test: `/metrics`, whose middleware registers with the process-wide Prometheus registry.

Model: opus-5-5

2026-10-03 17:49:43 +02:00

..

cors_internal_test.go

Send CORS headers only from the image routes (closes #98)

2026-10-03 17:49:43 +02:00

http_internal_test.go

Add the four settings the README documented but pixa lacked (closes #61)

2026-09-29 08:49:18 +02:00

http.go

Add the four settings the README documented but pixa lacked (closes #61)

2026-09-29 08:49:18 +02:00

login_rate_limit_internal_test.go

Answer image requests with 503 in maintenance mode (closes #71)

2026-09-29 11:01:30 +02:00

maintenance_internal_test.go

Send CORS headers only from the image routes (closes #98)

2026-10-03 17:49:43 +02:00

routes.go

Send CORS headers only from the image routes (closes #98)

2026-10-03 17:49:43 +02:00

server.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00