feat: multi-origin CORS + msp-api placeholder + calendar route stub #14

Merged

YousifShkara merged 74 commits from feat/cors-multi-origin-and-placeholder into main

2026-05-15 05:36:04 +02:00

vas2000-work commented

2026-05-15 00:06:32 +02:00

Owner

Three related changes for the v0.2.0 milestone:

1. Multi-origin CORS (CORS_ORIGIN env var)

The outer api router now builds AllowOrigin::list(...) from a
comma-separated CORS_ORIGIN env var. Falls back to [CLIENT_ORIGIN]
if unset, so dev is unchanged. create_api_router gains a
cors_origins: Vec<String> parameter; the only callsite (main.rs) is updated.

Required for the staging/prod split where the SPA (msp.<tld>) and API
(msp-api.<tld>) are different origins.

2. msp-api placeholder fallback

.fallback(get(not_a_frontend)) swallows any non-/api/v1/* request
with a small HTML page that links back to the matching Bunyip apex
(derived by stripping msp-api. from the Host header). Browser
visits to msp-api.<tld> no longer leak 404 internals; /api/v1/health
still returns plain 200 for Traefik.

3. Calendar route stub (GET /api/v1/calendar/events)

First real route in the calendar module. Tenant-scoped via RequireAuth,
filtered by ?from=&to=. Currently returns Vec<CalendarEvent>::new()
because there's no persistence yet; a follow-up adds the migration,
repository, and create/update/delete routes. The frontend's progressive
fall-back keeps the calendar usable in the meantime.

🤖 Generated with Claude Code

Three related changes for the v0.2.0 milestone: **1. Multi-origin CORS** (CORS_ORIGIN env var) The outer api router now builds `AllowOrigin::list(...)` from a comma-separated `CORS_ORIGIN` env var. Falls back to `[CLIENT_ORIGIN]` if unset, so dev is unchanged. `create_api_router` gains a `cors_origins: Vec<String>` parameter; the only callsite (main.rs) is updated. Required for the staging/prod split where the SPA (msp.\<tld>) and API (msp-api.\<tld>) are different origins. **2. msp-api placeholder fallback** `.fallback(get(not_a_frontend))` swallows any non-`/api/v1/*` request with a small HTML page that links back to the matching Bunyip apex (derived by stripping `msp-api.` from the `Host` header). Browser visits to msp-api.\<tld> no longer leak 404 internals; `/api/v1/health` still returns plain 200 for Traefik. **3. Calendar route stub** (`GET /api/v1/calendar/events`) First real route in the calendar module. Tenant-scoped via `RequireAuth`, filtered by `?from=&to=`. Currently returns `Vec<CalendarEvent>::new()` because there's no persistence yet; a follow-up adds the migration, repository, and create/update/delete routes. The frontend's progressive fall-back keeps the calendar usable in the meantime. 🤖 Generated with Claude Code

vas2000-work added 11 commits

2026-05-15 00:06:32 +02:00