Skip to content

add cors middleware - #549

Draft
slashburygin wants to merge 3 commits into
masterfrom
cors
Draft

add cors middleware#549
slashburygin wants to merge 3 commits into
masterfrom
cors

Conversation

@slashburygin

@slashburygin slashburygin commented Aug 2, 2026 •
edited by sourcery-ai Bot
Loading

Copy link
Copy Markdown
Contributor

Summary by Sourcery

Introduce configurable CORS support to the user API by adding a dedicated middleware and wiring it into the WSGI application and CLI configuration.

New Features:

  • Add a CORSMiddleware that handles CORS preflight requests and sets appropriate CORS response headers based on allowed origins.
  • Expose a new cors configuration group with an allowed_origins list option for controlling which origins may access the user API.

Enhancements:

  • Update the user API WSGI application builder to accept allowed_origins and attach the CORS middleware into the middleware chain.
  • Wire the cors configuration into the user API command entrypoint so allowed_origins from config are passed to the CORS middleware.

@sourcery-ai

sourcery-ai Bot commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Reviewer's Guide

Introduce a configurable CORS middleware for the user API WSGI application, wired through oslo.config options and applied to both preflight OPTIONS requests and normal responses based on allowed origins.

Sequence diagram for CORS middleware request handling

sequenceDiagram
    actor Client
    participant CORSMiddleware
    participant OpenApiApplication

    Client->>CORSMiddleware: HTTP request
    activate CORSMiddleware
    CORSMiddleware->>CORSMiddleware: __call__(req)
    alt [req.method == OPTIONS and _is_origin_allowed(origin)]
        CORSMiddleware-->>Client: req.ResponseClass(status=200, headers=_cors_headers(origin))
    else [non-OPTIONS or origin not allowed]
        CORSMiddleware->>OpenApiApplication: req.get_response(application)
        activate OpenApiApplication
        OpenApiApplication-->>CORSMiddleware: response
        deactivate OpenApiApplication
        alt [_is_origin_allowed(origin)]
            CORSMiddleware->>CORSMiddleware: _cors_headers(origin)
            CORSMiddleware->>Client: response with CORS headers
        else [origin not allowed]
            CORSMiddleware-->>Client: response without CORS headers
        end
    end
    deactivate CORSMiddleware
Loading

File-Level Changes

Change Details Files
Add a CORSMiddleware implementation and config registration utilities for handling CORS headers and preflight requests.
  • Define oslo.config option group and list option for allowed CORS origins with sensible defaults and helper to register them on the global CONF object.
  • Implement CORSMiddleware that short-circuits OPTIONS requests when the Origin is allowed and attaches CORS headers to normal responses.
  • Provide helper methods to compute CORS headers and check whether a request origin is permitted.
 exordos_core/common/api/middlewares/cors.py
Integrate the new CORSMiddleware into the user API WSGI application construction pipeline.
  • Extend build_wsgi_application signature to accept allowed_origins parameter.
  • Configure and insert CORSMiddleware at the front of the middleware stack using middlewares.configure_middleware, passing through allowed_origins.
  • Keep existing security and IAM middlewares unchanged but ordered after CORS.
 exordos_core/user_api/api/app.py
Wire CORS configuration into the user API command-line entrypoint to pass configured allowed origins into the WSGI app.
  • Import the CORS middleware module in the user API cmd module.
  • Register the CORS oslo.config option group and options on process startup.
  • Read configured allowed_origins from the cors group and pass them to build_wsgi_application when creating the WSGI server.
 exordos_core/cmd/user_api.py
Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

dependabot Bot and others added 2 commits August 2, 2026 23:08
@dependabot @slashburygin
build(deps): bump restalchemy (#525)
80fca10 
Bumps the core-packages group with 1 update in the / directory: [restalchemy](https://github.com/infraguys/restalchemy).

Updates `restalchemy` from 15.2.2 to 15.2.8
- [Release notes](https://github.com/infraguys/restalchemy/releases)
- [Commits](infraguys/restalchemy@15.2.2...15.2.8)

---
updated-dependencies:
- dependency-name: restalchemy
  dependency-version: 15.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: core-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@slashburygin
add cors middleware
90c7f47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@slashburygin