cors-proxy: Phase 1 — WAC-gated proxy for browser apps (#378)#379

Merged

melvincarvalho merged 18 commits into

issue-378-cors-proxy

May 8, 2026

Commits on May 8, 2026

cors-proxy: Phase 1 — WAC-gated proxy for browser apps (#378)
melvincarvalho
committed
cors-proxy: Copilot review fixes (security + correctness)
melvincarvalho
committed
cors-proxy: tighten Copilot review pass 2 — timeout scope, port docs
melvincarvalho
committed
cors-proxy: Copilot review pass 3 — strip Content-Length, expand Allow-Headers, override Allow-Credentials
melvincarvalho
committed
cors-proxy: Copilot review pass 4 — per-method ACL mode, numeric guards, comment fix
melvincarvalho
committed
cors-proxy: Copilot review pass 5 — paymentRequired pass-through, drop forwarded content-length
melvincarvalho
committed
cors-proxy: emit partial slice at byte cap instead of dropping whole chunk
melvincarvalho
committed
cors-proxy: Copilot review pass 7 — virtual-resource WAC + byte-cap boundary
melvincarvalho
committed
cors-proxy: Copilot review pass 8 — strip Authorization on cross-origin redirect, JSDoc
melvincarvalho
committed
cors-proxy: Copilot review pass 9 — WAC-Allow on 402, Allow on 405, drop dead branch
melvincarvalho
committed
cors-proxy: Copilot review pass 10 — JSDoc completeness, comment accuracy
melvincarvalho
committed
cors-proxy: Copilot review pass 11 — surface paid-access headers
melvincarvalho
committed
cors-proxy: Copilot review pass 12 — short-circuit OPTIONS, JSDoc paid type
melvincarvalho
committed
cors-proxy: Copilot review pass 13 — expose payment headers, WAC-Allow on success
melvincarvalho
committed
cors-proxy: Copilot review pass 14 — strip pod-authoritative headers, CSP sandbox
melvincarvalho
committed
cors-proxy: Copilot review pass 15 — strip Content-Range/Accept-Ranges from upstream
melvincarvalho
committed
cors-proxy: Copilot review pass 16 — preserve HEAD across redirects, fix dotfile guard
melvincarvalho
committed
cors-proxy: review pass 17 — fix misleading STRIP_RESPONSE_HEADERS comment about WAC-Allow ordering
melvincarvalho
committed