Function TestCORSHeaderValues

internal/api/cors_test.go:136–190

(t *testing.T)

}

func TestCORSHeaderValues(t *testing.T) {
	// Create test config with JWT private key
	testSeed := make([]byte, ed25519.SeedSize)
	_, err := rand.Read(testSeed)
	require.NoError(t, err)

	cfg := config.NewConfig()
	cfg.JWTPrivateKey = hex.EncodeToString(testSeed)

	// Create test services
	db := database.NewTestDB(t)
	registryService := service.NewRegistryService(db, cfg)

	shutdownTelemetry, metrics, err := telemetry.InitMetrics("test")
	assert.NoError(t, err)
	defer func() { _ = shutdownTelemetry(nil) }()

	versionInfo := &v0.VersionBody{
		Version:   "test",
		GitCommit: "test",
		BuildTime: "test",
	}

	// Create server
	_ = api.NewServer(cfg, registryService, metrics, versionInfo)

	// Test that CORS is configured with correct values
	// This is more of a documentation test to ensure we know what CORS settings we use

	t.Run("CORS should allow all origins", func(t *testing.T) {
		// AllowedOrigins: []string{"*"}
		// This is tested via integration tests
		t.Log("CORS allows all origins (*)")
	})

	t.Run("CORS should allow standard HTTP methods", func(t *testing.T) {
		// AllowedMethods: GET, POST, PUT, DELETE, OPTIONS
		t.Log("CORS allows GET, POST, PUT, DELETE, OPTIONS")
	})

	t.Run("CORS should allow all headers", func(t *testing.T) {
		// AllowedHeaders: []string{"*"}
		t.Log("CORS allows all headers (*)")
	})

	t.Run("CORS should not allow credentials with wildcard origin", func(t *testing.T) {
		// AllowCredentials: false (required when origin is *)
		t.Log("CORS does not allow credentials (required for wildcard origin)")
	})

	t.Run("CORS should set max age to 24 hours", func(t *testing.T) {
		// MaxAge: 86400 (24 hours)
		t.Log("CORS max age is 86400 seconds (24 hours)")
	})
}