pastilhasandClaude Opus 5
1e3dff27f5
The /api/music exemption was not enough on its own: an app has to reach /api/auth to sign in before it ever calls its own feature, so the login was still 403ing on Invalid origin. ALLOW_ANY_ORIGIN=true now accepts every Origin everywhere and skips the per-origin path scoping. Set on this host; ALLOW_ANY_ORIGIN_MUSIC stays as the narrower option. The account backstop is deliberately NOT disabled — a valid non-owner token is still confined to /api/auth + /api/music whatever Origin it claims, because that rule is account-based rather than origin-based, and it is the airtight half of the pair. Every protected route still requires a valid token. Reverting is an env edit and a restart. Both flags and their call sites come out when the tailnet becomes the perimeter. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>