From a85160555638899aa0d4c9d4396da630adfa3702 Mon Sep 17 00:00:00 2001
From: Conrad Hoffmann <ch@bitfehler.net>
Date: Wed, 23 Jul 2025 13:24:21 +0200
Subject: [PATCH] server: handle CORS in server

Currently CORS is handled in nginx in front of the API. That setup is
not very suitable for Kubernetes. Instead, handle CORS here, so we do
not need any intermediaries between the ingress and the APIs.

The CORS settings are taken from sr.ht-nginx/graphql.conf [1]

[1] https://git.sr.ht/~sircmpwn/sr.ht-nginx/tree/master/item/graphql.conf
---
 go.mod           | 1 +
 go.sum           | 2 ++
 server/server.go | 8 ++++++++
 3 files changed, 11 insertions(+)

diff --git a/go.mod b/go.mod
index 817427884587e9c2c001d40d1d95072d55740efe..5f89bc8516f3f910e1dc8c3b841919390aeb9421 100644
--- a/go.mod
+++ b/go.mod
@@ -20,6 +20,7 @@ require (
 	github.com/emersion/go-smtp v0.21.3
 	github.com/fernet/fernet-go v0.0.0-20211208181803-9f70042a33ee
 	github.com/go-chi/chi/v5 v5.0.10
+	github.com/go-chi/cors v1.2.2
 	github.com/go-redis/redis/v8 v8.11.5
 	github.com/google/uuid v1.6.0
 	github.com/jackc/pgx/v5 v5.7.4
diff --git a/go.sum b/go.sum
index 27656268b771c6220a428456dfad3e0add61a829..f9ad27b8b113d81694eb2a4b9a76dd54ae8a2995 100644
--- a/go.sum
+++ b/go.sum
@@ -68,6 +68,8 @@ github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWo
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/go-chi/chi/v5 v5.0.10 h1:rLz5avzKpjqxrYwXNfmjkrYYXOyLJd37pz53UFHC6vk=
 github.com/go-chi/chi/v5 v5.0.10/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
+github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
+github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
diff --git a/server/server.go b/server/server.go
index 31f9af01c3bd0de7add977fdf8e475f50d66915c..601c5f04cac5ef7b20a759b3f304542c564fff44 100644
--- a/server/server.go
+++ b/server/server.go
@@ -23,6 +23,7 @@ import (
 	"github.com/99designs/gqlgen/graphql/playground"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
+	"github.com/go-chi/cors"
 	goRedis "github.com/go-redis/redis/v8"
 	reuseport "github.com/kavu/go_reuseport"
 	_ "github.com/lib/pq"
@@ -216,6 +217,13 @@ func (server *Server) WithDefaultMiddleware() *Server {
 			requestsProcessed.Inc()
 		})
 	})
+	server.router.Use(cors.Handler(cors.Options{
+		AllowedOrigins: []string{"*"},
+		AllowedMethods: []string{"GET", "POST", "OPTIONS"},
+		AllowedHeaders: []string{"User-Agent", "X-Requested-With", "If-Modified-Since", "Cache-Control", "Content-Type", "Range"},
+		ExposedHeaders: []string{"Content-Length", "Content-Range"},
+		MaxAge:         1728000,
+	}))
 	server.router.Use(config.Middleware(server.conf, server.service))
 	server.router.Use(email.Middleware(server.email))
 	server.router.Use(database.Middleware(db))