chore: work towards web support with cors

Author: nadilas

apps/api/go.mod

@@ -67,6 +67,7 @@ require (
 require (
 	buf.build/gen/go/gnostic/gnostic/protocolbuffers/go v1.36.6-20230414000709-087bc8072ce4.1 // indirect
 	cel.dev/expr v0.24.0 // indirect
+	connectrpc.com/cors v0.1.0 // indirect
 	github.com/PaesslerAG/gval v1.2.4 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/bytedance/sonic v1.13.3 // indirect
@@ -109,6 +110,7 @@ require (
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
+	github.com/rs/cors v1.11.1 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/stoewer/go-strcase v1.3.1 // indirect
 	github.com/tidwall/btree v1.8.0 // indirect

apps/api/go.sum

@@ -2,18 +2,9 @@ package main
 
 import (
 	"bytes"
-	"connectrpc.com/grpcreflect"
-	"connectrpc.com/vanguard"
 	"context"
 	"errors"
 	"fmt"
-	"github.com/arl/statsviz"
-	sentrygin "github.com/getsentry/sentry-go/gin"
-	"github.com/gin-contrib/cors"
-	"github.com/gin-contrib/static"
-	openapi2 "go.dot.industries/brease/openapi"
-	trace2 "go.dot.industries/brease/trace"
-	"go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin"
 	"io"
 	"log"
 	"net/http"
@@ -22,6 +13,19 @@ import (
 	"strings"
 	"time"
 
+	connectcors "connectrpc.com/cors"
+	"connectrpc.com/grpcreflect"
+	"connectrpc.com/vanguard"
+	"github.com/arl/statsviz"
+	sentrygin "github.com/getsentry/sentry-go/gin"
+	"github.com/gin-contrib/cors"
+	"github.com/gin-contrib/static"
+	cors2 "github.com/rs/cors"
+	openapi2 "go.dot.industries/brease/openapi"
+	trace2 "go.dot.industries/brease/trace"
+	"go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin"
+	"golang.org/x/exp/slog"
+
 	"buf.build/gen/go/dot/brease/connectrpc/go/brease/auth/v1/authv1connect"
 	"buf.build/gen/go/dot/brease/connectrpc/go/brease/context/v1/contextv1connect"
 	"connectrpc.com/connect"
@@ -153,16 +157,27 @@ func newApp(db storage.Database, logger *zap.Logger) *gin.Engine {
 
 	// config CORS
 	config := cors.DefaultConfig()
+	config.AllowCredentials = true
+	config.AllowMethods = append(connectcors.AllowedMethods(), "OPTIONS")
+	config.AllowHeaders = connectcors.AllowedHeaders()
+	config.ExposeHeaders = connectcors.ExposedHeaders()
+	var allowedOrigins []string
 	originsStr := env.Getenv("BREASE_CORS_ALLOW_ORIGINS", "*")
 	if originsStr == "*" {
 		config.AllowAllOrigins = true
+		allowedOrigins = append(allowedOrigins, "*")
 	} else {
 		origins := strings.Split(originsStr, ",")
 		config.AllowOrigins = append(config.AllowOrigins, origins...)
+		allowedOrigins = append(allowedOrigins, origins...)
 		logger.Info(
 			"CORS origins",
 			zap.Strings("origins", origins),
 		)
+		config.AllowOriginFunc = func(origin string) bool {
+			slog.Error("Trying origin check", "origin", origin, "allowedOrigin", origins)
+			return true
+		}
 	}
 
 	r.Use(cors.New(config))
@@ -244,7 +259,7 @@ func newApp(db storage.Database, logger *zap.Logger) *gin.Engine {
 	}
 
 	mux := http.NewServeMux()
-	mux.Handle("/", transcoder)
+	mux.Handle("/", withCORS(transcoder, allowedOrigins))
 
 	// add grpc reflection support for tools like `buf curl` or `grpcurl`
 	mux.Handle(grpcreflect.NewHandlerV1(grpcreflect.NewStaticReflector(authv1connect.AuthServiceName, contextv1connect.ContextServiceName)))
@@ -255,6 +270,22 @@ func newApp(db storage.Database, logger *zap.Logger) *gin.Engine {
 	return r
 }
 
+// withCORS adds CORS support to a Connect HTTP handler.
+func withCORS(h http.Handler, origins []string) http.Handler {
+	middleware := cors2.New(cors2.Options{
+		AllowedOrigins:   origins,
+		AllowCredentials: true,
+		AllowedMethods:   connectcors.AllowedMethods(),
+		AllowedHeaders:   connectcors.AllowedHeaders(),
+		ExposedHeaders:   connectcors.ExposedHeaders(),
+		AllowOriginFunc: func(origin string) bool {
+			slog.Info("Trying origin check", "origin", origin, "allowedOrigin", origins)
+			return true
+		},
+	})
+	return middleware.Handler(h)
+}
+
 func auditLogStore(logger *zap.Logger) auditlog.Store {
 	stores := auditlog.Stores{auditlogstore.NewLog(auditlogstore.LogConfig{Verbosity: 5}, logger)}
 	if redisURL := env.Getenv("REDIS_URL", ""); redisURL != "" {