refactor: update CORS variable naming

Refs: KK-1463

Author: mhieta

.env.example

@@ -1,5 +1,4 @@
 SECRET_KEY=
-CORS_ORIGIN_ALLOW_ALL=1
 APPLY_MIGRATIONS=1
 ADD_DEFAULT_LANGUAGES=1
 DEBUG=1
@@ -22,7 +21,7 @@ POSTGRES_DB=kukkuu
 SKIP_DATABASE_CHECK=0
 ALLOWED_HOSTS=*
 CORS_ALLOWED_ORIGINS=http://localhost:3000,http://localhost:3001,http://localhost:3002
-CORS_ORIGIN_ALLOW_ALL=True
+CORS_ALLOW_ALL_ORIGINS=True
 # For Keycloak test environment authentication service:
 TOKEN_AUTH_AUTHSERVER_URL=https://tunnistus.test.hel.ninja/auth/realms/helsinki-tunnistus
 # For local Tunnistamo authentication service:

kukkuu/settings.py

@@ -54,7 +54,7 @@
     SENTRY_ENVIRONMENT=(str, ""),
     CORS_ALLOWED_ORIGINS=(list, []),
     CORS_ALLOWED_ORIGIN_REGEXES=(list, []),
-    CORS_ORIGIN_ALLOW_ALL=(bool, False),
+    CORS_ALLOW_ALL_ORIGINS=(bool, False),
     SOCIAL_AUTH_TUNNISTAMO_KEY=(str, ""),
     SOCIAL_AUTH_TUNNISTAMO_SECRET=(str, ""),
     SOCIAL_AUTH_TUNNISTAMO_OIDC_ENDPOINT=(str, ""),
@@ -329,7 +329,7 @@ def sentry_before_send(event: Event, hint: Hint):
 
 CORS_ALLOWED_ORIGINS = env("CORS_ALLOWED_ORIGINS")
 CORS_ALLOWED_ORIGIN_REGEXES = env("CORS_ALLOWED_ORIGIN_REGEXES")
-CORS_ORIGIN_ALLOW_ALL = env("CORS_ORIGIN_ALLOW_ALL")
+CORS_ALLOW_ALL_ORIGINS = env("CORS_ALLOW_ALL_ORIGINS")
 
 # Configure the default CSP rule for different source types
 CSP_DEFAULT_SRC = ["'self'"]

kukkuu/tests/test_cors.py

@@ -7,7 +7,7 @@ def test_cors_allowed_origin(settings, live_server, client: Client):
     settings.CORS_ALLOWED_ORIGINS = [
         live_server.url,
     ]
-    settings.CORS_ORIGIN_ALLOW_ALL = False
+    settings.CORS_ALLOW_ALL_ORIGINS = False
     response = client.get("/admin/login/", HTTP_ORIGIN=live_server.url)
     assert response.status_code == 200
     assert response["Access-Control-Allow-Origin"] == live_server.url
@@ -16,7 +16,7 @@ def test_cors_allowed_origin(settings, live_server, client: Client):
 @pytest.mark.django_db(transaction=True)
 def test_cors_disallowed_origin(settings, live_server, client: Client):
     settings.CORS_ALLOWED_ORIGINS = [live_server.url]
-    settings.CORS_ORIGIN_ALLOW_ALL = False
+    settings.CORS_ALLOW_ALL_ORIGINS = False
     response = client.get("/admin/login/", HTTP_ORIGIN="http://malicious.com")
     assert response.status_code == 200  # The request still succeeds...
     assert (