clawbot 62f46c3a49 Send CORS headers only from the image routes (closes #98) ...

The CORS middleware, with the access_control_allow_origin origin, moved
from the router root onto a /v1 subrouter holding /v1/image/ and /v1/e/.
The login and URL generator pages, /metrics, the health check,
robots.txt and /static/ no longer send Access-Control-Allow-Origin, so
their safety no longer rests on the CORS options chosen for the image
routes.

It is a subrouter rather than a route group because a group's
middleware runs only for a request that matches one of its routes, and
a preflight OPTIONS request matches none. The maintenance mode group
moved inside it unchanged.

README.md and config.example.yml say the setting covers the image
routes only.

Model: opus-5-5

2026-09-29 11:00:22 +00:00

..

cors_internal_test.go

Test that only the image routes send CORS headers (closes #98)

2026-09-29 10:54:50 +00:00

http_internal_test.go

Add the four settings the README documented but pixa lacked (closes #61)

2026-09-29 08:49:18 +02:00

http.go

Add the four settings the README documented but pixa lacked (closes #61)

2026-09-29 08:49:18 +02:00

login_rate_limit_internal_test.go

Answer image requests with 503 in maintenance mode (closes #71)

2026-09-29 11:01:30 +02:00

maintenance_internal_test.go

Test that only the image routes send CORS headers (closes #98)

2026-09-29 10:54:50 +00:00

routes.go

Send CORS headers only from the image routes (closes #98)

2026-09-29 11:00:22 +00:00

server.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00