add cors middleware

[slashburygin]

Summary by Sourcery

Introduce configurable CORS support to the user API by adding a dedicated middleware and wiring it into the WSGI application and CLI configuration.

New Features:

• Add a CORSMiddleware that handles CORS preflight requests and sets appropriate CORS response headers based on allowed origins.
• Expose a new cors configuration group with an allowed_origins list option for controlling which origins may access the user API.

Enhancements:

• Update the user API WSGI application builder to accept allowed_origins and attach the CORS middleware into the middleware chain.
• Wire the cors configuration into the user API command entrypoint so allowed_origins from config are passed to the CORS middleware.

[sourcery-ai]

Reviewer's Guide

Introduce a configurable CORS middleware for the user API WSGI application, wired through oslo.config options and applied to both preflight OPTIONS requests and normal responses based on allowed origins.

Sequence diagram for CORS middleware request handling

sequenceDiagram
    actor Client
    participant CORSMiddleware
    participant OpenApiApplication

    Client->>CORSMiddleware: HTTP request
    activate CORSMiddleware
    CORSMiddleware->>CORSMiddleware: __call__(req)
    alt [req.method == OPTIONS and _is_origin_allowed(origin)]
        CORSMiddleware-->>Client: req.ResponseClass(status=200, headers=_cors_headers(origin))
    else [non-OPTIONS or origin not allowed]
        CORSMiddleware->>OpenApiApplication: req.get_response(application)
        activate OpenApiApplication
        OpenApiApplication-->>CORSMiddleware: response
        deactivate OpenApiApplication
        alt [_is_origin_allowed(origin)]
            CORSMiddleware->>CORSMiddleware: _cors_headers(origin)
            CORSMiddleware->>Client: response with CORS headers
        else [origin not allowed]
            CORSMiddleware-->>Client: response without CORS headers
        end
    end
    deactivate CORSMiddleware

Loading

File-Level Changes

Change	Details	Files
Add a CORSMiddleware implementation and config registration utilities for handling CORS headers and preflight requests.	Define oslo.config option group and list option for allowed CORS origins with sensible defaults and helper to register them on the global CONF object. Implement CORSMiddleware that short-circuits OPTIONS requests when the Origin is allowed and attaches CORS headers to normal responses. Provide helper methods to compute CORS headers and check whether a request origin is permitted.	exordos_core/common/api/middlewares/cors.py
Integrate the new CORSMiddleware into the user API WSGI application construction pipeline.	Extend build_wsgi_application signature to accept allowed_origins parameter. Configure and insert CORSMiddleware at the front of the middleware stack using middlewares.configure_middleware, passing through allowed_origins. Keep existing security and IAM middlewares unchanged but ordered after CORS.	exordos_core/user_api/api/app.py
Wire CORS configuration into the user API command-line entrypoint to pass configured allowed origins into the WSGI app.	Import the CORS middleware module in the user API cmd module. Register the CORS oslo.config option group and options on process startup. Read configured allowed_origins from the cors group and pass them to build_wsgi_application when creating the WSGI server.	exordos_core/cmd/user_api.py

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.