refactor: update CORS variable naming

Refs: PT-1940

Author: mhieta

.env.example

@@ -45,7 +45,7 @@ POSTGRES_DB=kultus
 SKIP_DATABASE_CHECK=0
 ALLOWED_HOSTS=*
 CORS_ALLOWED_ORIGINS=http://localhost:3000,http://localhost:3001,http://localhost:3002
-CORS_ORIGIN_ALLOW_ALL=True
+CORS_ALLOW_ALL_ORIGINS=True
 TOKEN_AUTH_BROWSER_TEST_ENABLED=1
 TOKEN_AUTH_BROWSER_TEST_JWT_256BIT_SIGN_SECRET=your-256-bit-secret
 TOKEN_AUTH_BROWSER_TEST_JWT_ISSUER=https://kultus-ui.test.hel.ninja,https://kultus-admin-ui.test.hel.ninja

palvelutarjotin/settings.py

@@ -49,7 +49,7 @@
     SENTRY_ENVIRONMENT=(str, ""),
     CORS_ALLOWED_ORIGINS=(list, []),
     CORS_ALLOWED_ORIGIN_REGEXES=(list, []),
-    CORS_ORIGIN_ALLOW_ALL=(bool, False),
+    CORS_ALLOW_ALL_ORIGINS=(bool, False),
     TOKEN_AUTH_ACCEPTED_SCOPE_PREFIX=(str, ""),
     TOKEN_AUTH_REQUIRE_SCOPE_PREFIX=(bool, False),
     TOKEN_AUTH_ACCEPTED_AUDIENCE=(list, ["kultus-api-dev"]),
@@ -268,8 +268,7 @@
 
 CORS_ALLOWED_ORIGINS = env.list("CORS_ALLOWED_ORIGINS")
 CORS_ALLOWED_ORIGIN_REGEXES = env.list("CORS_ALLOWED_ORIGIN_REGEXES")
-CORS_ORIGIN_ALLOW_ALL = env.bool("CORS_ORIGIN_ALLOW_ALL")
-
+CORS_ALLOW_ALL_ORIGINS = env.bool("CORS_ALLOW_ALL_ORIGINS")
 
 # Configure the default CSP rule for different source types
 CSP_DEFAULT_SRC = [CSP.SELF]

palvelutarjotin/tests/test_cors.py

@@ -7,7 +7,7 @@ def test_cors_allowed_origin(settings, live_server, client: Client):
     settings.CORS_ALLOWED_ORIGINS = [
         live_server.url,
     ]
-    settings.CORS_ORIGIN_ALLOW_ALL = False
+    settings.CORS_ALLOW_ALL_ORIGINS = False
     response = client.get("/admin/login/", HTTP_ORIGIN=live_server.url)
     assert response.status_code == 200
     assert response["Access-Control-Allow-Origin"] == live_server.url
@@ -16,7 +16,7 @@ def test_cors_allowed_origin(settings, live_server, client: Client):
 @pytest.mark.django_db(transaction=True)
 def test_cors_disallowed_origin(settings, live_server, client: Client):
     settings.CORS_ALLOWED_ORIGINS = [live_server.url]
-    settings.CORS_ORIGIN_ALLOW_ALL = False
+    settings.CORS_ALLOW_ALL_ORIGINS = False
     response = client.get("/admin/login/", HTTP_ORIGIN="http://malicious.com")
     assert response.status_code == 200  # The request still succeeds...
     assert (