Module cors 

CORS handling, ported from the reference response-side CORS surface.

The engine owns the verdict; adapters (and the conformance runner) apply the returned map to their responses, composing on top of the security-header set exactly like apply_cors_headers. Reference sources: get_cors_headers (_security_headers_cors.py), the config resolution (_compute_cors_config), and the SecurityConfig CORS field defaults.

The wildcard + credentials misconfiguration is NOT rejected: the reference _compute_cors_config logs an error and drops the credentials flag at resolution time, so the wildcard policy answers without the allow-credentials header (the browser blocks credentialed CORS), and a disallowed origin simply gets no CORS headers (the browser enforces).

Example

use guard_core_engine::cors::{CorsConfig, cors_response_headers};

let cors = CorsConfig {
    enabled: true,
    allow_origins: vec!["https://app.example.com".to_owned()],
    ..CorsConfig::default()
};
let headers = cors_response_headers(&cors, Some("https://app.example.com"));
assert_eq!(
    headers.get("Access-Control-Allow-Origin").map(String::as_str),
    Some("https://app.example.com")
);
assert_eq!(
    headers.get("Access-Control-Allow-Methods").map(String::as_str),
    Some("GET, POST, PUT, PATCH, DELETE, OPTIONS")
);

// A disallowed origin gets nothing (the browser enforces).
assert!(cors_response_headers(&cors, Some("https://evil.example.com")).is_empty());

Structs

CorsConfig

The resolved CORS configuration: _compute_cors_config’s returned state, with the SecurityConfig CORS field defaults.

CorsPreflightResponse

The reference CorsPreflightResponse: the status, the header set, and the plain-text body the preflight answer renders.

PreflightRequest

The reference build_preflight_response’s request view: the three headers the preflight validation reads (each already extracted by the adapter from its own header map).

Constants

ALLOWED_PREFLIGHT_REQUEST_HEADER

The preflight request header the reference gates an OPTIONS request on (ALLOWED_PREFLIGHT_REQUEST_HEADER).

Functions

build_preflight_response

The reference build_preflight_response (cors_handler.py).

cors_response_headers

get_cors_headers composed with _build_cors_headers.

downgrade_wildcard_credentials

_compute_cors_config’s wildcard + credentials downgrade, in place.

is_origin_allowed

_is_origin_allowed: the wildcard or exact membership.

is_preflight

The reference is_preflight: an OPTIONS method (case-insensitive) carrying the access-control-request-method header.