GareArc 218ef6a447 feat(api): CORS posture for /openapi/v1 (Phase A.5) ...

OPENAPI_CORS_ALLOW_ORIGINS env var defaults to empty (same-origin only).
Operators expand for third-party integrations via comma-separated list.
Allowed headers: Authorization, Content-Type, X-CSRF-Token. Methods:
GET POST PATCH DELETE OPTIONS. Max-Age 600s. supports_credentials=True
so cookie-authed approve/deny work once Phase D moves them in.

Disallowed origins receive a normal 200 OPTIONS response without the
Access-Control-Allow-Origin header — flask-cors's standard behavior;
browser blocks the cross-origin request from the disallowed origin.

Plan: docs/superpowers/plans/2026-04-26-openapi-migration.md (in difyctl repo).

2026-04-26 23:30:27 -07:00

..

__init__.py

feat(api): scaffold /openapi/v1 blueprint (Phase A.1)

2026-04-26 23:08:15 -07:00

test_cors.py

feat(api): CORS posture for /openapi/v1 (Phase A.5)

2026-04-26 23:30:27 -07:00

test_health.py

feat(api): scaffold /openapi/v1 blueprint (Phase A.1)

2026-04-26 23:08:15 -07:00