mirror of
https://github.com/lfnovo/open-notebook.git
synced 2026-05-20 00:56:18 +00:00
ec41ef8f2f
Some checks failed
Development Build / extract-version (push) Has been cancelled
Tests / Backend Tests (push) Has been cancelled
Tests / Frontend Tests (push) Has been cancelled
Development Build / build-regular (push) Has been cancelled
Development Build / build-single (push) Has been cancelled
Development Build / summary (push) Has been cancelled
Replace hardcoded `allow_origins=["*"]` with a parsed `CORS_ORIGINS` environment variable (comma-separated). Default remains `*` for backward compatibility — no existing deployment breaks — but the API now logs a startup warning prompting users to set it explicitly for production. Exception handlers now route their CORS headers through a shared `_cors_headers()` helper that mirrors Starlette's CORSMiddleware behavior: reflects the request Origin when allowed (handling the browser-rejected `*` + credentials combination correctly), and omits `Access-Control-Allow-Origin` for disallowed origins so error bodies don't leak cross-origin when `CORS_ORIGINS` is configured. Closes #585, #730. Based on the original work by Greg Grace in #597; rewritten on top of current main to address prior review feedback (load_dotenv kept at top, `import os` grouped with stdlib, `_cors_headers` defined before its exception-handler callers, origins parsed once at module load) and to choose a non-breaking default paired with a startup warning instead of a stricter-by-default origin. Co-authored-by: Greg Grace <ggrace@519lab.com> |
||
|---|---|---|
| .. | ||
| routers | ||
| __init__.py | ||
| auth.py | ||
| chat_service.py | ||
| CLAUDE.md | ||
| client.py | ||
| command_service.py | ||
| context_service.py | ||
| credentials_service.py | ||
| embedding_service.py | ||
| episode_profiles_service.py | ||
| insights_service.py | ||
| main.py | ||
| models.py | ||
| models_service.py | ||
| notebook_service.py | ||
| notes_service.py | ||
| podcast_api_service.py | ||
| podcast_service.py | ||
| search_service.py | ||
| settings_service.py | ||
| sources_service.py | ||
| transformations_service.py | ||