add cors middleware

Author: slashburygin

exordos_core/cmd/user_api.py

@@ -31,6 +31,7 @@
 from exordos_core.common import constants as c
 from exordos_core.common import log as infra_log
 from exordos_core.common import utils
+from exordos_core.common.api.middlewares import cors as cors_mw
 from exordos_core.user_api.api import app
 from exordos_core.user_api.iam import drivers as iam_drivers
 
@@ -75,6 +76,7 @@
 CONF.register_cli_opts(iam_cli_opts, DOMAIN_IAM)
 ra_config_opts.register_posgresql_db_opts(CONF)
 sdk_opts.register_event_opts(CONF)
+cors_mw.register_cors_opts(CONF)
 
 
 def main():
@@ -119,6 +121,7 @@ def main():
             wsgi_app=app.build_wsgi_application(
                 context_storage=context_storage,
                 iam_engine_driver=iam_engine_driver,
+                allowed_origins=CONF["cors"].allowed_origins,
             ),
             host=CONF[DOMAIN].bind_host,
             port=CONF[DOMAIN].bind_port,

exordos_core/common/api/middlewares/cors.py

@@ -0,0 +1,79 @@
+#    Copyright 2026 Genesis Corporation.
+#
+#    All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from oslo_config import cfg
+from webob import dec
+
+from restalchemy.api import middlewares
+
+ALLOWED_ORIGINS_OPT = cfg.ListOpt(
+    "allowed_origins",
+    default=["*"],
+    help="List of allowed CORS origins",
+)
+
+CORS_OPT_GROUP = cfg.OptGroup("cors")
+CORS_OPTS = [ALLOWED_ORIGINS_OPT]
+BASE_RESPONSE_HEADERS = {
+    "Access-Control-Allow-Credentials": "true",
+    "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": (
+        "Authorization, Content-Type, X-OTP-Token, X-Requested-With, "
+        "Accept, Origin"
+    ),
+    "Access-Control-Max-Age": "3600",
+}
+
+
+def register_cors_opts(conf):
+    conf.register_group(CORS_OPT_GROUP)
+    conf.register_opts(CORS_OPTS, group=CORS_OPT_GROUP)
+
+
+class CORSMiddleware(middlewares.Middleware):
+
+    def __init__(self, application, allowed_origins=None):
+        super().__init__(application)
+        self.allowed_origins = allowed_origins or []
+
+    @dec.wsgify
+    def __call__(self, req):
+        origin = req.headers.get("Origin", "")
+
+        if req.method == "OPTIONS" and self._is_origin_allowed(origin):
+            return req.ResponseClass(
+                status=200,
+                headers=self._cors_headers(origin),
+            )
+
+        response = req.get_response(self.application)
+
+        if self._is_origin_allowed(origin):
+            for key, value in self._cors_headers(origin).items():
+                response.headers.add(key, value)
+
+        return response
+
+    def _is_origin_allowed(self, origin):
+        if not origin:
+            return False
+        return origin in self.allowed_origins or "*" in self.allowed_origins
+
+    @staticmethod
+    def _cors_headers(origin):
+        headers = BASE_RESPONSE_HEADERS.copy()
+        headers["Access-Control-Allow-Origin"] = origin
+        return headers

exordos_core/user_api/api/app.py

@@ -24,6 +24,7 @@
 
 from exordos_core import version
 from exordos_core.common import contexts as common_contexts
+from exordos_core.common.api.middlewares import cors as cors_mw
 from exordos_core.common.api.middlewares import errors as errors_mw
 from exordos_core.user_api.api import middlewares as user_api_mw
 from exordos_core.user_api.api import routes as app_routes
@@ -60,13 +61,17 @@ def get_openapi_engine():
     return openapi_engine
 
 
-def build_wsgi_application(context_storage, iam_engine_driver):
+def build_wsgi_application(context_storage, iam_engine_driver, allowed_origins=None):
     return middlewares.attach_middlewares(
         applications.OpenApiApplication(
             route_class=get_api_application(),
             openapi_engine=get_openapi_engine(),
         ),
         [
+            middlewares.configure_middleware(
+                cors_mw.CORSMiddleware,
+                allowed_origins=allowed_origins or [],
+            ),
             user_api_mw.SecurityRulesMiddleware,
             middlewares.configure_middleware(
                 iam_mw.GenesisCoreAuthMiddleware,