Sansan d31bf3551c Allow CORS origins from CORS_ALLOWED_ORIGINS ...

Echo compares allowed origins literally, so "https://*" and "http://*" never
matched a real origin and no CORS headers were sent. The allowed origins now
come from CORS_ALLOWED_ORIGINS (comma-separated, checked at startup). When it
is empty, only same-origin requests work, which is enough for the bundled
frontend.

Credentials are no longer allowed since the API uses Bearer tokens. Browsers
may now send Range and X-Queue-Id and read X-Queue-Id and Content-Range.

2026-10-07 20:03:13 +02:00

..

backend

Store each client's play queue in the database

2026-10-07 20:03:03 +02:00

config

Allow CORS origins from CORS_ALLOWED_ORIGINS

2026-10-07 20:03:13 +02:00

db

Store each client's play queue in the database

2026-10-07 20:03:03 +02:00

logging

test: add simple unit tests for backend and logging packages

2026-05-22 22:49:25 +02:00

server

Allow CORS origins from CORS_ALLOWED_ORIGINS

2026-10-07 20:03:13 +02:00

testutil

Store each client's play queue in the database

2026-10-07 20:03:03 +02:00