From f3549b035e788d73fc277354b622e202124d1497 Mon Sep 17 00:00:00 2001
From: jamesread <contact@jread.com>
Date: Thu, 26 Feb 2026 20:46:11 +0000
Subject: [PATCH] Remove dead CORS package (L-2)

The CORS helper was unused; its import was commented out in webuiServer.go.
Deleting the package removes the dormant origin-reflection security issue.
---
 service/internal/cors/cors.go               | 23 ---------------------
 service/internal/cors/cors_test.go          | 22 --------------------
 service/internal/httpservers/webuiServer.go |  2 --
 3 files changed, 47 deletions(-)
 delete mode 100644 service/internal/cors/cors.go
 delete mode 100644 service/internal/cors/cors_test.go

diff --git a/service/internal/cors/cors.go b/service/internal/cors/cors.go
deleted file mode 100644
index 905ed46..0000000
--- a/service/internal/cors/cors.go
+++ /dev/null
@@ -1,23 +0,0 @@
-package cors
-
-import (
-	log "github.com/sirupsen/logrus"
-	"net/http"
-)
-
-// AllowCors takes a HTTP handler and adds Access-Control-Allow-Origin headers to
-// responses.
-//
-// Note: HTTP OPTIONS requests (which need to be preflighted" for CORS) are not
-// handled because this app does not use HTTP PUT/PATCH/etc.
-func AllowCors(h http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if origin := r.Header.Get("Origin"); origin != "" {
-			log.Debugf("Adding CORS header origin: %q", origin)
-
-			w.Header().Set("Access-Control-Allow-Origin", origin)
-		}
-
-		h.ServeHTTP(w, r)
-	})
-}
diff --git a/service/internal/cors/cors_test.go b/service/internal/cors/cors_test.go
deleted file mode 100644
index bfd87e2..0000000
--- a/service/internal/cors/cors_test.go
+++ /dev/null
@@ -1,22 +0,0 @@
-package cors
-
-import (
-	"github.com/stretchr/testify/assert"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-func TestCors(t *testing.T) {
-	req, _ := http.NewRequest("GET", "/health-check", nil)
-	req.Header.Add("Origin", "1.2.3.4")
-
-	blat := AllowCors(http.FileServer(http.Dir(".")))
-
-	rr := httptest.NewRecorder()
-
-	blat.ServeHTTP(rr, req)
-
-	assert.Equal(t, http.StatusNotFound, rr.Code, "HTTP 404 on CORS")
-	assert.Equal(t, "1.2.3.4", rr.Header().Get("Access-Control-Allow-Origin"), "CORS Header set")
-}
diff --git a/service/internal/httpservers/webuiServer.go b/service/internal/httpservers/webuiServer.go
index fb718ba..5b76c06 100644
--- a/service/internal/httpservers/webuiServer.go
+++ b/service/internal/httpservers/webuiServer.go
@@ -1,8 +1,6 @@
 package httpservers
 
 import (
-
-	//	cors "github.com/OliveTin/OliveTin/internal/cors"
 	"net/http"
 	"os"
 	"path"