From 0b97d46522777238d7dd8f3e83c1ed499a3effcd Mon Sep 17 00:00:00 2001
From: "dobby-yivi-agent[bot]"
 <275734547+dobby-yivi-agent[bot]@users.noreply.github.com>
Date: Wed, 1 Jul 2026 23:10:57 +0000
Subject: [PATCH] fix(pg-pkg)!: require explicit --allowed-origins for CORS
 (#216)

Remove `default_value = "*"` from the `--allowed-origins` /
`PKG_ALLOWED_ORIGINS` clap option and mark it `required = true`, so the
PKG server refuses to start unless the operator explicitly supplies an
allowed-origins list. This prevents CORS from being silently open to all
origins in production. The wildcard `*` is still accepted, but only as an
explicit opt-in.

entrypoint.sh now passes PKG_ALLOWED_ORIGINS through with no fallback
(matching the existing IRMA_TOKEN idiom). The dev docker-compose sets
PKG_ALLOWED_ORIGINS=* explicitly so local dev keeps working.

BREAKING CHANGE: `--allowed-origins` / `PKG_ALLOWED_ORIGINS` is now
required. The previous `*` default is gone, so any pg-pkg deployment that
relied on the implicit wildcard must now set an allowlist explicitly (use
`*` to keep the old open-CORS behaviour deliberately).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 docker-compose.yml |  3 +++
 entrypoint.sh      |  1 +
 pg-pkg/src/opts.rs | 10 ++++++----
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index f4769d2..ea01b84 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -21,6 +21,9 @@ services:
             - RUST_BACKTRACE=1
             - IRMA_SERVER=http://irma-server:8088
             - DATABASE_URL=postgres://devuser:devpassword@postgres:5432/devdb
+            # allowed-origins is required (no default); dev explicitly opts into
+            # the wildcard so local cross-origin requests work.
+            - PKG_ALLOWED_ORIGINS=*
         networks:
             - pg-network
         depends_on:
diff --git a/entrypoint.sh b/entrypoint.sh
index b2ea970..d7ec69a 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -24,6 +24,7 @@ fi
 exec /usr/local/bin/pg-pkg server \
     ${IRMA_TOKEN:+-t "$IRMA_TOKEN"} \
     -i "${IRMA_SERVER:-https://is.yivi.app}" \
+    ${PKG_ALLOWED_ORIGINS:+--allowed-origins "$PKG_ALLOWED_ORIGINS"} \
     --ibe-secret-path "$KEYS_DIR/pkg_ibe.sec" \
     --ibe-public-path "$KEYS_DIR/pkg_ibe.pub" \
     --ibs-secret-path "$KEYS_DIR/pkg_ibs.sec" \
diff --git a/pg-pkg/src/opts.rs b/pg-pkg/src/opts.rs
index 238b049..80d95c7 100644
--- a/pg-pkg/src/opts.rs
+++ b/pg-pkg/src/opts.rs
@@ -85,14 +85,16 @@ pub struct ServerOpts {
     pub ibs_public_path: String,
 
     /// Comma-separated list of origins allowed to make cross-origin requests
-    /// to the PKG. The special value `*` allows any origin (the historical
-    /// default), but is discouraged for production deployments that handle
-    /// key material. Example:
+    /// to the PKG. This option is required and has no default: the server
+    /// refuses to start unless an allowlist is supplied, so CORS is never
+    /// silently open to all origins in production. The special value `*`
+    /// allows any origin, but must be opted into explicitly and is discouraged
+    /// for deployments that handle key material. Example:
     /// `--allowed-origins https://postguard.eu,https://postguard.nl`.
     #[clap(
         long,
         env = "PKG_ALLOWED_ORIGINS",
-        default_value = "*",
+        required = true,
         value_delimiter = ','
     )]
     pub allowed_origins: Vec<String>,