Struct CorsDefinition 

pub struct CorsDefinition {
    pub name: String,
    pub allow_origins: Vec<String>,
    pub allow_methods: Vec<String>,
    pub allow_headers: Vec<String>,
    pub allow_credentials: bool,
    pub max_age: Option<String>,
    pub expose_headers: Vec<String>,
    pub loc: Loc,
    pub leading_trivia: Vec<Trivia>,
    pub trailing_trivia: Vec<Trivia>,
}

cors Name { allow_origins:, allow_methods:, allow_headers:, allow_credentials:, max_age:, expose_headers: }

v2.38.0 — a named, referenced origin-policy declaration, mirroring shield’s shape exactly: declared once, referenced from any number of axonendpoints via cors: <Name> (AxonEndpointDefinition::cors_ref). Makes the browser-facing origin policy a property of the ENDPOINT, resolved per the tenant’s live deployed bundle — the shape a single process-wide CORS knob (the market-standard pattern) cannot express for a multi-tenant deploy where different bundles need different origins for a path with the same name.

Unknown fields are a hard parse error — a CORS policy is security-relevant, so upstream/voice’s stricter posture is followed here, not shield’s lenient axon-W010 record-and-skip.

Fields

name: String

allow_origins: Vec<String>

["https://app.example.com", "https://*.kivi.io"] — exact origins or a single leading-wildcard host-label glob (the design decision/T854); no full regex, matching the closed/decidable spirit of the rest of the language. ["*"] (any-origin) is legal UNLESS allow_credentials is also true — that combination is axon-T853 (the design decision, the CORS spec’s own rule, caught at compile time instead of a silent browser rejection).

allow_methods: Vec<String>

Reuses the closed axonendpoint method catalog (GET/POST/PUT/ PATCH/DELETE) — validated against the same list, not a free string (T855).

allow_headers: Vec<String>

Request headers the preflight may allow (e.g. ["Content-Type", "Authorization"]) — free-form header-name strings (hyphens are common in real header names, hence string literals, not bare identifiers).

allow_credentials: bool

true ⇒ Access-Control-Allow-Credentials: true is emitted. Forbidden together with an any-origin allow_origins (T853).

max_age: Option<String>

Access-Control-Max-Age — a duration literal ("3600s", "1h"), same lexer/token convention as axonendpoint.timeout. None ⇒ the header is omitted (browser default caching applies).

expose_headers: Vec<String>

Access-Control-Expose-Headers — response headers the browser’s JS may read beyond the CORS-safelisted set. Free-form strings, same rationale as allow_headers.

loc: Loc

leading_trivia: Vec<Trivia>

v1.5.2 — leading comment trivia.

trailing_trivia: Vec<Trivia>

v1.5.2 — trailing comment trivia.

Trait Implementations

impl Debug for CorsDefinition

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for CorsDefinition

fn default() -> CorsDefinition

Returns the “default value” for a type.