Set a CORS policy

[JesseAbram]

In #164 I added web endpoints. I made cors policy open, figure out if that is ok or needs to be tightened

[edjroz]

I think the policy should likely be addressed based on a couple categories:

• Read-only discovery: InfoService.GetNodeInfo, InfoService.GetRingState. Any client legitimately needs these before doing anything else; revealing them broadly should be fine.
• End-user secret flow: StoreSecretService.StoreSecret, PreService.StartPre Security envelope is the encryption proof + access policy on the bulletin, not CORS.
• High-stakes signing: SignService.StartSign. Threshold-signing oracle; an unauthorized sign means money moves. Same shape as Store/Pre but with the highest blast radius if authn/authz ever has a bug.
• Operator/admin — DkgService.StartDkg. Spins up a new threshold key with a peer set. No end-user UX; should arguably never be reachable from a browser at all.

So with that in mind:

1. InfoService, permissive by default (it's discovery data).
2. StoreSecret / StartPre / StartSign, restrictive by default; operators pass an explicit allow-list (e.g. --cors-allowed-origins https://app.example). * is still accepted as an explicit opt-in for dev.
3. StartDkg, no gRPC-Web exposure at all; CLI/control-plane only.

I have one more question:

• Auth model sanity check: nothing here uses cookies / session credentials,Token or signature in headers only? (If yes, the risk of permissive CORS is lower than it sounds, but the per-service-defaults argument still stands for StartSign.)

[JesseAbram]

I do like this design, but the cors policy goes deeper. Since we do not control deployments or nodes, we have to define if a node operator should choose a list, and how, if we can update on the fly and how complex to make it where we don't add too much functionality but create too much complexity.

Im thinking having a devops and devrel opinion in this makes sense and to just kick the can on this until we are closer to prod

[JesseAbram]

oh also yes sigs in the headers no cookie sessions

[edjroz]

Oh I was referring to these as the Defaults, an option so a user can turn knobs is a non negotiable for infra