yml
ecab6ae9b7
feat: complete CORS config-driven middleware rewrite
- cors.ts: createCorsMiddleware factory with RuntimeConfig param
- Wildcard ['*'] mode: Access-Control-Allow-Origin: * (backward compatible)
- Specific origins mode: reflect matching origin + Allow-Credentials
- Added Access-Control-Max-Age: 86400 for preflight caching
- app.ts: accept config param, use createCorsMiddleware(config)
- index.ts: pass runtimeConfig to createApp
- env-overrides.ts: add string[] to RuntimeConfigValue, corsOriginsEnv helper
- runtime-config.ts: cors.allowedOrigins: string[] type
- defaults.ts: cors.allowedOrigins: ['*'] default
- .env: CORS_ALLOWED_ORIGINS=* with production example