Merge pull request #92 from FIWARE/ticket-33/work

Added configurable CORS origins to VCVerifier

Author: wistefan

IMPLEMENTATION_PLAN.md

@@ -0,0 +1,79 @@
+# Implementation Plan: VCVerifier should allow to configure CORS headers
+
+## Overview
+
+The VCVerifier currently has a hardcoded CORS configuration in `main.go` (lines 51–57) that allows all origins (`*`), only `POST`/`GET` methods, and a fixed set of headers. The ticket requests making CORS origins configurable as part of the service configuration (`ConfiguredService` in `config/configClient.go`), including support for the wildcard origin. This plan adds an `AllowedOrigins` field to `ConfiguredService`, updates the CORS middleware to read from configuration, and preserves backward compatibility (wildcard by default when nothing is configured).
+
+## Steps
+
+### Step 1: Add CORS configuration field to ConfiguredService and update config parsing
+
+**Goal:** Extend the `ConfiguredService` struct to accept an `allowedOrigins` list, so each service can declare which origins are permitted.
+
+**Files to modify:**
+- `config/configClient.go` — Add `AllowedOrigins []string` field (with `json:"allowedOrigins,omitempty" mapstructure:"allowedOrigins,omitempty"`) to the `ConfiguredService` struct (line 40).
+
+**Acceptance criteria:**
+- `ConfiguredService` has a new `AllowedOrigins []string` field with appropriate `json` and `mapstructure` tags.
+- The field is optional (`omitempty`); when absent, it defaults to an empty/nil slice (meaning "no restriction specified by this service").
+- The field is documented with a GoDoc comment explaining its purpose and that `["*"]` means allow all origins.
+
+### Step 2: Wire CORS middleware to use configured origins from all services
+
+**Goal:** Replace the hardcoded CORS config in `main.go` with logic that aggregates `AllowedOrigins` from all configured services and passes them to the `gin-contrib/cors` middleware. When no origins are configured anywhere (or no services exist), fall back to the current wildcard behavior for backward compatibility.
+
+**Files to modify:**
+- `main.go` — Update the CORS middleware setup (lines 51–57) to:
+  1. Accept the `Configuration` struct.
+  2. Collect all `AllowedOrigins` values from `configuration.ConfigRepo.Services`.
+  3. Deduplicate the collected origins.
+  4. If the aggregated list is empty (no services configured any origins), default to `["*"]` for backward compatibility.
+  5. If `"*"` is present in the aggregated list, use `["*"]` (wildcard takes precedence).
+  6. Pass the resolved origins to `cors.Config.AllowOrigins`.
+
+**Design notes:**
+- Extract the CORS origin resolution into a dedicated, exported helper function (e.g., `func ResolveAllowedOrigins(services []config.ConfiguredService) []string`) in `main.go` or a small utility so it can be unit-tested independently.
+- Keep `AllowMethods`, `AllowHeaders`, and `AllowCredentials` at their current hardcoded values — the ticket only asks for origin configuration.
+- Note: `gin-contrib/cors` does not allow `AllowCredentials: true` with `AllowOrigins: ["*"]`. The current code has this combination, which means credentials are effectively not sent cross-origin. Maintain this existing behavior for now — do not change `AllowCredentials`. If the wildcard is resolved, keep the same config as today.
+
+**Acceptance criteria:**
+- When no `allowedOrigins` are set on any service, CORS behaves identically to today (wildcard).
+- When services specify origins, only those origins are allowed.
+- When any service specifies `"*"`, the wildcard is used.
+- The helper function is exported and documented.
+
+### Step 3: Update test fixtures and add unit tests
+
+**Goal:** Add test coverage for the new configuration field parsing and the CORS origin resolution logic.
+
+**Files to modify/create:**
+- `config/data/config_test.yaml` — Add `allowedOrigins` to the existing test service entry.
+- `config/provider_test.go` — Update the `Test_ReadConfig` table-driven test's expected `ConfiguredService` to include the new `AllowedOrigins` field.
+- `main_test.go` (new file, or add to existing test file if one exists) — Add parameterized tests for the `ResolveAllowedOrigins` helper function covering:
+  - No services → returns `["*"]`
+  - Services with no `allowedOrigins` set → returns `["*"]`
+  - Single service with specific origins → returns those origins
+  - Multiple services with different origins → returns deduplicated union
+  - Any service includes `"*"` → returns `["*"]`
+  - Duplicate origins across services → deduplicated
+
+**Files to modify:**
+- `config/data/config_test.yaml` — Add `allowedOrigins: ["https://example.com"]` under the test service.
+- `config/provider_test.go` — Update expected struct to include `AllowedOrigins: []string{"https://example.com"}`.
+- `main_test.go` — New file with parameterized table-driven tests for `ResolveAllowedOrigins`.
+
+**Acceptance criteria:**
+- `go test ./config/... -v` passes with the updated fixture and expected values.
+- `go test ./... -v` passes, including the new `ResolveAllowedOrigins` tests.
+- Tests cover all edge cases listed above using table-driven test pattern.
+
+### Step 4: Update example configuration and documentation
+
+**Goal:** Update `server.yaml` to document the new `allowedOrigins` option so operators know it exists.
+
+**Files to modify:**
+- `server.yaml` — Add a commented-out `allowedOrigins` example under the `configRepo.services` section showing usage (e.g., `# allowedOrigins: ["https://my-app.example.com"]`). If `configRepo.services` is not present in `server.yaml`, add a commented-out example block.
+
+**Acceptance criteria:**
+- `server.yaml` contains a clear, commented example showing how to configure `allowedOrigins` for a service, including a note that `["*"]` is the default when omitted.
+- The application still starts correctly with the updated `server.yaml` (no parse errors from comments).

VCVerifier

@@ -44,6 +44,11 @@ type ConfiguredService struct {
 	Id                string                `json:"id" mapstructure:"id"`
 	AuthorizationType string                `json:"authorizationType,omitempty" mapstructure:"authorizationType,omitempty"`
 	AuthorizationPath string                `json:"authorizationPath,omitempty" mapstructure:"authorizationPath,omitempty"`
+	// AllowedOrigins specifies the list of origins permitted for CORS requests
+	// to this service. When empty or nil, no service-specific restriction is
+	// applied and the verifier falls back to the global default (wildcard).
+	// Set to ["*"] to explicitly allow all origins for this service.
+	AllowedOrigins []string `json:"allowedOrigins,omitempty" mapstructure:"allowedOrigins,omitempty"`
 }
 
 type ScopeEntry struct {

config/configClient.go

@@ -36,6 +36,7 @@ configRepo:
   services:
     - id: testService
       defaultOidcScope: someScope
+      allowedOrigins: ["https://example.com"]
       oidcScopes:
         someScope:
           credentials:

config/data/config_test.yaml

@@ -72,6 +72,7 @@ func Test_ReadConfig(t *testing.T) {
 						{
 							Id:               "testService",
 							DefaultOidcScope: "someScope",
+							AllowedOrigins:   []string{"https://example.com"},
 							ServiceScopes: map[string]ScopeEntry{
 								"someScope": {
 									Credentials: []Credential{

config/provider_test.go

@@ -48,9 +48,11 @@ func main() {
 	// health check
 	router.GET("/health", HealthReq)
 
+	allowedOrigins := ResolveAllowedOrigins(configuration.ConfigRepo.Services)
+	logger.Infof("CORS allowed origins: %v", allowedOrigins)
+
 	router.Use(cors.New(cors.Config{
-		// we need to allow all, since we do not know the potential origin of a wallet
-		AllowOrigins:     []string{"*"},
+		AllowOrigins:     allowedOrigins,
 		AllowMethods:     []string{"POST", "GET"},
 		AllowHeaders:     []string{"Origin", "Content-Type", "Authorization"},
 		AllowCredentials: true,
@@ -138,3 +140,39 @@ func init() {
 	}
 	logging.Log().Infof("Will read config from %s", configFile)
 }
+
+// wildcardOrigin is the CORS origin value that permits requests from any origin.
+const wildcardOrigin = "*"
+
+// ResolveAllowedOrigins aggregates the AllowedOrigins from all configured
+// services into a deduplicated list of CORS origins. The rules are:
+//
+//   - If no services are provided, or none of them specify any AllowedOrigins,
+//     the function returns ["*"] (wildcard) for backward compatibility.
+//   - If any service includes "*" in its AllowedOrigins, the function returns
+//     ["*"] because the wildcard takes precedence over specific origins.
+//   - Otherwise the function returns the deduplicated union of all origins.
+func ResolveAllowedOrigins(services []configModel.ConfiguredService) []string {
+	seen := make(map[string]struct{})
+	var origins []string
+
+	for _, svc := range services {
+		for _, origin := range svc.AllowedOrigins {
+			if origin == wildcardOrigin {
+				// Wildcard takes precedence — no need to collect further.
+				return []string{wildcardOrigin}
+			}
+			if _, exists := seen[origin]; !exists {
+				seen[origin] = struct{}{}
+				origins = append(origins, origin)
+			}
+		}
+	}
+
+	// No origins configured at all — default to wildcard for backward compatibility.
+	if len(origins) == 0 {
+		return []string{wildcardOrigin}
+	}
+
+	return origins
+}

main.go

@@ -0,0 +1,122 @@
+package main
+
+import (
+	"reflect"
+	"sort"
+	"testing"
+
+	"github.com/fiware/VCVerifier/config"
+)
+
+func TestResolveAllowedOrigins(t *testing.T) {
+	tests := []struct {
+		name     string
+		services []config.ConfiguredService
+		want     []string
+	}{
+		{
+			name:     "no services returns wildcard",
+			services: nil,
+			want:     []string{"*"},
+		},
+		{
+			name:     "empty services slice returns wildcard",
+			services: []config.ConfiguredService{},
+			want:     []string{"*"},
+		},
+		{
+			name: "services with no allowedOrigins returns wildcard",
+			services: []config.ConfiguredService{
+				{Id: "svc1"},
+				{Id: "svc2"},
+			},
+			want: []string{"*"},
+		},
+		{
+			name: "services with empty allowedOrigins returns wildcard",
+			services: []config.ConfiguredService{
+				{Id: "svc1", AllowedOrigins: []string{}},
+			},
+			want: []string{"*"},
+		},
+		{
+			name: "single service with specific origins",
+			services: []config.ConfiguredService{
+				{Id: "svc1", AllowedOrigins: []string{"https://example.com", "https://app.example.com"}},
+			},
+			want: []string{"https://example.com", "https://app.example.com"},
+		},
+		{
+			name: "multiple services with different origins returns deduplicated union",
+			services: []config.ConfiguredService{
+				{Id: "svc1", AllowedOrigins: []string{"https://alpha.com"}},
+				{Id: "svc2", AllowedOrigins: []string{"https://beta.com"}},
+			},
+			want: []string{"https://alpha.com", "https://beta.com"},
+		},
+		{
+			name: "duplicate origins across services are deduplicated",
+			services: []config.ConfiguredService{
+				{Id: "svc1", AllowedOrigins: []string{"https://shared.com", "https://alpha.com"}},
+				{Id: "svc2", AllowedOrigins: []string{"https://shared.com", "https://beta.com"}},
+			},
+			want: []string{"https://shared.com", "https://alpha.com", "https://beta.com"},
+		},
+		{
+			name: "any service with wildcard returns wildcard only",
+			services: []config.ConfiguredService{
+				{Id: "svc1", AllowedOrigins: []string{"https://example.com"}},
+				{Id: "svc2", AllowedOrigins: []string{"*"}},
+			},
+			want: []string{"*"},
+		},
+		{
+			name: "first service with wildcard short-circuits",
+			services: []config.ConfiguredService{
+				{Id: "svc1", AllowedOrigins: []string{"*"}},
+				{Id: "svc2", AllowedOrigins: []string{"https://example.com"}},
+			},
+			want: []string{"*"},
+		},
+		{
+			name: "wildcard mixed within origins of a single service",
+			services: []config.ConfiguredService{
+				{Id: "svc1", AllowedOrigins: []string{"https://example.com", "*", "https://other.com"}},
+			},
+			want: []string{"*"},
+		},
+		{
+			name: "mix of configured and unconfigured services",
+			services: []config.ConfiguredService{
+				{Id: "svc1"},
+				{Id: "svc2", AllowedOrigins: []string{"https://example.com"}},
+				{Id: "svc3", AllowedOrigins: []string{}},
+			},
+			want: []string{"https://example.com"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := ResolveAllowedOrigins(tt.services)
+
+			// Sort both slices for order-independent comparison when not testing
+			// wildcard (wildcard is always a single element so order is irrelevant).
+			if len(got) > 1 || len(tt.want) > 1 {
+				sortedGot := make([]string, len(got))
+				copy(sortedGot, got)
+				sort.Strings(sortedGot)
+
+				sortedWant := make([]string, len(tt.want))
+				copy(sortedWant, tt.want)
+				sort.Strings(sortedWant)
+
+				if !reflect.DeepEqual(sortedGot, sortedWant) {
+					t.Errorf("ResolveAllowedOrigins() = %v, want %v", got, tt.want)
+				}
+			} else if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("ResolveAllowedOrigins() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

main_test.go

@@ -22,3 +22,26 @@ verifier:
                     registryAddress: https://registry.gaia-x.fiware.dev/development/api/complianceIssuers
 ssiKit:
     auditorURL: http://my-auditor
+
+# configRepo defines the service configurations with their scopes and trust endpoints.
+# Each service under configRepo.services can optionally specify allowedOrigins to control
+# which origins are permitted for CORS requests. When omitted or empty, the default
+# behavior is to allow all origins (["*"]) for backward compatibility.
+#
+# configRepo:
+#   services:
+#     - id: my-service
+#       defaultOidcScope: defaultScope
+#       # allowedOrigins restricts CORS requests to the listed origins for this service.
+#       # Origins from all services are merged into a single deduplicated list.
+#       # If any service includes "*", all origins are allowed (wildcard).
+#       # If omitted or empty, defaults to ["*"] (allow all origins).
+#       allowedOrigins:
+#         - "https://my-app.example.com"
+#         - "https://admin.example.com"
+#       oidcScopes:
+#         defaultScope:
+#           credentials:
+#             - type: VerifiableCredential
+#               trustedIssuersLists:
+#                 - https://tir.example.com