chore(refarch-gateway): restrict default cors config

[darenegade]

Pull Request

Changes

• add a restrictive global CORS default for all routes so cross-origin access is denied unless configured explicitly
• make global, public and client CORS settings centrally overridable via environment variables with inherited defaults
• document the new CORS defaults, override precedence and broader default scope in gateway docs and known issues

Reference

Issue: #internal&66

Checklist

General

• Met all acceptance criteria of the issue
• Added meaningful PR title and list of changes in the description
• Created / Updated documentation (in English)

Code

• Wrote code and comments in English
• Removed waste on branch (for example console.log), see code quality tooling

[coderabbitai]

📝 Walkthrough

Walkthrough

Gateway CORS rules now use environment-variable-driven defaults, including a catch-all path and specific overrides for /public/** and /clients/**. Documentation describes restrictive defaults, configuration aliases, CORS buckets, and override precedence.

Changes

Gateway CORS

Layer / File(s)	Summary
Environment-driven CORS rules refarch-gateway/src/main/resources/application.yml	Adds a catch-all CORS rule and parameterizes origins, headers, credentials, and methods for each configured path.
CORS routing guidance docs/gateway.md, docs/support/known-issues.md	Documents default-deny behavior, environment-variable overrides, CORS buckets, and precedence for specific paths.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: devtobi

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: restricting the default CORS configuration.
Description check	✅ Passed	The description matches the template well with Changes, Reference, and Checklist sections filled in and relevant items marked.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/restrict-gateway-cors-defaults

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[simonhir]

Would be breaking