Add CORS support for cross-origin API access

[Copilot]

Cross-origin headers were missing from all endpoints, blocking external applications from accessing Whyis APIs and data.

Changes

Dependencies

• Added Flask-CORS>=3.0.10 to setup.py

CORS Configuration (whyis/app.py)

• Configured Flask-CORS in configure_extensions() to apply to all routes (r"/*")
• Three configurable parameters with secure defaults:
  • CORS_ORIGINS: "*" (default), single origin, or comma-separated list
  • CORS_SUPPORTS_CREDENTIALS: False (default), validated against wildcard usage
  • CORS_MAX_AGE: 3600 (default), preflight cache duration
• Automatic validation prevents supports_credentials=True with wildcard origins per CORS spec
• Proper logging for configuration warnings

Tests (tests/api/test_cors.py)

• Verify CORS headers on root, SPARQL, and API endpoints
• Validate preflight OPTIONS requests
• Assert allowed methods, headers, and max age values

Configuration Examples

Default (all origins, no credentials):

# No config needed

Restricted origins with credentials:

CORS_ORIGINS = "https://example.com, https://app.example.com"
CORS_SUPPORTS_CREDENTIALS = True

Implementation

cors_origins = self.config.get('CORS_ORIGINS', '*')
if cors_origins != '*':
    cors_origins = [origin.strip() for origin in cors_origins.split(',')] if ',' in cors_origins else [cors_origins.strip()]

supports_credentials = self.config.get('CORS_SUPPORTS_CREDENTIALS', False)
if supports_credentials and cors_origins == '*':
    self.logger.warning("CORS: Cannot use credentials with wildcard. Disabling.")
    supports_credentials = False

CORS(self, resources={
    r"/*": {
        "origins": cors_origins,
        "methods": ["GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"],
        "allow_headers": ["Content-Type", "Authorization", "Accept"],
        "supports_credentials": supports_credentials,
        "max_age": self.config.get('CORS_MAX_AGE', 3600)
    }
})

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[github-actions]

✅ Vue.js tests passed! Coverage report available in artifacts.