ALLOWED_ORIGINS: support multiple origins via env for actors stack #4

New issue

Closed

opened 2026-06-26 15:22:23 +00:00 by Mark · 1 comment

Mark commented

2026-06-26 15:22:23 +00:00

Owner

Context

The service currently sets ALLOWED_ORIGINS as a single env var. The deployment doc has ALLOWED_ORIGINS=https://threadcraft.markkeers.com for the wild deploy.

The actors-test stack (#20 in Mark/Kimi_Agent_Brother_10_Digitizing_App) will hit the same service image from a different origin (whatever node_hub exposes the frontend under in the actors compose). To avoid forking the service image per environment, allow the allowlist to accept multiple comma-separated origins from a single env var.

Goal

ALLOWED_ORIGINS accepts comma-separated origins. Wild deploy uses one origin; actors stack uses another; the image is the same.

Acceptance

ALLOWED_ORIGINS=a.com,b.com,c.com permits all three; missing entries produce 403 with CORS error, not a startup crash.
Empty / unset ALLOWED_ORIGINS keeps current behaviour (single origin or localhost dev origins, per existing config).
Test added covering multi-origin env parsing + CORS preflight for an entry not in the list.
Deployment doc updated to show the multi-origin form for the actors-stack case.

Mark/Kimi_Agent_Brother_10_Digitizing_App#20 — actors stack that motivates this change.
docs/deployment.md — env var source of truth.

Out of scope

Wild deploy topology (separate issue in ThreadCraft).
Per-tenant origin allowlist (single global list is enough for v1).

## Context The service currently sets `ALLOWED_ORIGINS` as a single env var. The deployment doc has `ALLOWED_ORIGINS=https://threadcraft.markkeers.com` for the wild deploy. The actors-test stack (#20 in Mark/Kimi_Agent_Brother_10_Digitizing_App) will hit the same service image from a **different** origin (whatever node_hub exposes the frontend under in the actors compose). To avoid forking the service image per environment, allow the allowlist to accept multiple comma-separated origins from a single env var. ## Goal `ALLOWED_ORIGINS` accepts comma-separated origins. Wild deploy uses one origin; actors stack uses another; the image is the same. ## Acceptance - [ ] `ALLOWED_ORIGINS=a.com,b.com,c.com` permits all three; missing entries produce 403 with CORS error, not a startup crash. - [ ] Empty / unset `ALLOWED_ORIGINS` keeps current behaviour (single origin or localhost dev origins, per existing config). - [ ] Test added covering multi-origin env parsing + CORS preflight for an entry not in the list. - [ ] Deployment doc updated to show the multi-origin form for the actors-stack case. ## Related - Mark/Kimi_Agent_Brother_10_Digitizing_App#20 — actors stack that motivates this change. - `docs/deployment.md` — env var source of truth. ## Out of scope - Wild deploy topology (separate issue in ThreadCraft). - Per-tenant origin allowlist (single global list is enough for v1).

Mark added the

triage-approved

needs-decompose

labels

2026-06-26 15:22:32 +00:00

Mark commented

2026-06-26 15:22:32 +00:00

Author

Owner

Auto-triage: needs decompose

Marked triage-approved + needs-decompose. decompose-executor will pick this up and break it into implementable sub-issues.

## Auto-triage: needs decompose Marked `triage-approved` + `needs-decompose`. decompose-executor will pick this up and break it into implementable sub-issues.

Mark

2026-06-26 17:56:56 +00:00