asepharyana
5aaedbf787
Meliputi: - File-level //! doc comment: tujuan file, alur kerja, komponen utama - Function-level /// doc comment: apa, parameter, return, flow, edge cases - Struct/enum/trait /// doc comment: peran, field docs - Tracing logging (tracing::info!/debug!/trace!/warn!/error!) di setiap fungsi - Inline comments untuk variable dan branching logic penting - Seluruh 8 crates di workspace: zesdex-backend, zesdex-cms, zesdex-entities, zesdex-iam, zesdex-infra, zesdex-ipc, zesdex-middleware, zesdex-utils - Build: 0 errors, 242/242 tests passed
52 lines
1.8 KiB
Rust
52 lines
1.8 KiB
Rust
//! CORS layer factory for the daemon HTTP (IPC) server.
|
|
//!
|
|
//! Since the daemon only listens on `127.0.0.1`, the CORS policy is
|
|
//! intentionally permissive. These settings are still required because
|
|
//! Axum rejects cross-origin requests unless a CORS layer is present.
|
|
|
|
use tower_http::cors::{AllowHeaders, AllowOrigin, CorsLayer};
|
|
|
|
/// Return a permissive [`CorsLayer`] for local daemon IPC.
|
|
///
|
|
/// - **Origin**: any (`*`)
|
|
/// - **Methods**: `GET`, `POST`, `PUT`, `DELETE`, `PATCH`, `OPTIONS`
|
|
/// - **Headers**: `Content-Type`, `Authorization`, `X-Session-Id`,
|
|
/// `X-Request-Id`, `User-Agent`
|
|
/// Return a permissive [`CorsLayer`] for local daemon IPC.
|
|
///
|
|
/// - **Origin**: any (`*`)
|
|
/// - **Methods**: `GET`, `POST`, `PUT`, `DELETE`, `PATCH`, `OPTIONS`
|
|
/// - **Headers**: `Content-Type`, `Authorization`, `X-Session-Id`,
|
|
/// `X-Request-Id`, `User-Agent`
|
|
///
|
|
/// Since the daemon only listens on localhost, any origin is allowed.
|
|
/// The exposed headers let the browser JS read session/request IDs.
|
|
pub fn default_cors_layer() -> CorsLayer {
|
|
CorsLayer::new()
|
|
.allow_origin(AllowOrigin::any()) // permissive — daemon is localhost-only
|
|
.allow_methods([
|
|
"GET".parse().unwrap(),
|
|
"POST".parse().unwrap(),
|
|
"PUT".parse().unwrap(),
|
|
"DELETE".parse().unwrap(),
|
|
"PATCH".parse().unwrap(),
|
|
"OPTIONS".parse().unwrap(),
|
|
]) // standard REST methods
|
|
.allow_headers(AllowHeaders::any())
|
|
.expose_headers([
|
|
"Content-Type".parse().unwrap(),
|
|
"X-Session-Id".parse().unwrap(),
|
|
"X-Request-Id".parse().unwrap(),
|
|
]) // headers exposed to the browser JS
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
#[test]
|
|
fn test_default_cors_layer_constructs() {
|
|
let _layer = default_cors_layer();
|
|
}
|
|
}
|