Two root causes identified and fixed:
1. tests/test_api_settings.py (TestListCredentials):
asyncio.get_event_loop().run_until_complete() raised RuntimeError in
Python 3.12 because test_api_auth_enabled.py's asyncio.run() sets the
current event loop to None on completion. Replace all 7 occurrences
with asyncio.run() which creates its own event loop each time.
2. tests/test_cors.py:
reload(app.config) replaced the app.config.settings singleton with a
new instance, so app modules holding the original reference no longer
saw patches applied to app.config.settings.X. This caused the
notification, OpenAI, and file-upload tests to behave as if unpatched.
Remove the redundant reload() calls — the tests only need a fresh
Settings(...) instance constructed with the env var already set.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Add CORSMiddleware (disabled by default, enabled via CORS_ENABLED=true)
- Add cors_enabled, cors_allowed_origins, cors_allow_credentials,
cors_allowed_methods, cors_allowed_headers settings to config.py
- Add parse_comma_separated_list validator for CORS list env vars
- Insert CORS middleware between SessionMiddleware and ProxyHeaders
so preflight runs before CSRF/auth but after proxy-header processing
- Document CORS env vars in .env.demo with rationale for proxy-first approach
- Mark CORS TODO as completed in SECURITY_AUDIT.md
- Add tests/test_cors.py with 12 unit and integration tests
Closes#175
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
copilot-swe-agent[bot]