2 Commits

Author	SHA1	Message	Date
ryan	9550fa6ff3	perf(cap): add runtime settings snapshot for dynamic config ... Replace per-request GetByKey calls with a singleflight-backed RuntimeSettings snapshot loaded via ListSystemConfigsByKeys. Invalidate snapshot on admin cap_* writes and via Redis pub/sub. Simplify VerifyMiddleware and update PERFORMANCE.md status.	2026-06-17 12:07:02 +08:00
ryan	f6f8c25930	fix(router): restrict CORS origin reflection to allowed hosts (AUTH-ROUTE-5) ... - Extract isOriginAllowed helper to match Origin against server_address configurations - Ensure arbitrary origins are not reflected and credentials are not allowed when server_address is unconfigured or mismatched - Trim trailing slashes from allowed origins configuration for robust matching - Add TestCORSMiddleware to cover all CORS matching and rejection scenarios	2026-06-13 10:23:20 +08:00