Add CORS support to S3 listener with origin pattern matching

[bajtos]

Summary

Adds configurable CORS (Cross-Origin Resource Sharing) support to the S3 listener, allowing browser-based clients to make cross-origin requests to the gateway. The implementation includes a flexible origin pattern matcher that supports exact origins, subdomain wildcards, and a catch-all wildcard, with strict validation at startup to catch configuration errors early.

Key Changes

• New internal/cors package — Pure string-matching logic for validating and matching request origins against configured patterns:

  • NewMatcher() parses and validates origin patterns (exact, subdomain wildcards like https://*.dev.example, or *)
  • Allows() checks if a request origin matches the configured allow-list
  • Strict validation rejects malformed patterns (bad schemes, paths, invalid wildcard placement) at startup rather than silently failing to match

• New corsMiddleware in root package — Fiber middleware that:

  • Echoes allowed origins back in Access-Control-Allow-Origin (with Vary: Origin for cache correctness)
  • Sets Access-Control-Expose-Headers to allow JavaScript access to ETag and x-amz-* metadata headers
  • Answers CORS preflight requests (OPTIONS with Access-Control-Request-Method) with 204 and short-circuits to avoid auth rejection
  • Deliberately never sets Access-Control-Allow-Credentials (S3 auth uses Authorization header and presigned URLs, not cookies)

• Configuration — Added CORSAllowedOrigins field to Config and ServerConfig:

  • Documented in config structs with usage examples
  • Validated during ServerConfig() mapping so typos fail at startup
  • Empty list disables CORS handling (the default)

• Integration — Wired into buildS3API() to mount the middleware when origins are configured

• Comprehensive tests:

  • internal/cors/cors_test.go — Unit tests for pattern parsing, validation, and matching logic (exact origins, wildcards, case-insensitivity, nested subdomains, edge cases)
  • cors_test.go — Integration tests for middleware behavior (allowed/disallowed origins, preflight handling, header correctness)

Implementation Details

• Origins are matched case-insensitively and trimmed of whitespace
• Wildcard patterns (https://*.dev.example) match any subdomain depth but validate that the matched part contains only valid DNS labels (alphanumerics and hyphens)
• Prevents suffix-matching tricks (e.g., https://evil.com/x.dev.example won't match a .dev.example pattern)
• Preflight requests from disallowed origins fall through to the router (which rejects them without CORS headers, signaling to the browser that the request is blocked)
• Non-preflight OPTIONS requests without Access-Control-Request-Method are treated as regular requests and fall through

https://claude.ai/code/session_015WqgCRxsD9tzd7L2m5mMLW

[Copilot]

Pull request overview

This PR adds configurable CORS handling to ingot’s embedded S3 listener, enabling browser-based cross-origin access while keeping origin authorization explicit via an allow-list matcher.

Changes:

• Introduces internal/cors origin-pattern parsing + matching (exact, https://*.example, and *) with unit tests.
• Adds a Fiber CORS middleware in the root ingot package and wires it into buildS3API() when configured.
• Extends config (cors_allowed_origins) with startup validation and test coverage.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
server.go	Builds s3api options via a slice and conditionally mounts the CORS middleware when origins are configured.
internal/cors/cors.go	Implements pattern parsing/validation and request-origin matching logic.
internal/cors/cors_test.go	Unit tests for matcher validation and matching behavior across exact/wildcard patterns.
cors.go	Adds the Fiber middleware that reflects allowed origins, exposes selected headers, and short-circuits preflights.
cors_test.go	Integration-style tests validating middleware header behavior and preflight handling.
config/server.go	Adds CORSAllowedOrigins to ServerConfig.
config/config.go	Adds cors_allowed_origins to Config, validates patterns during ServerConfig() mapping, and maps the field through.
config/config_test.go	Extends config validation tests to cover invalid CORS origin patterns.

Comments suppressed due to low confidence (1)

cors_test.go:49

• The current assertion only checks that the Vary header is non-empty. Since the middleware contract relies on varying by Origin for cache correctness, the test should assert that "Origin" is actually present in Vary.

		if got := resp.Header.Get("Vary"); got == "" {
			t.Error("Vary header missing on origin-reflected response")
		}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bajtos]

Ignoring the test failure, it seems to be caused by broken Smelt that's using Piri with sqlite which is no longer supported after Curio was incorporated into Piri.