pastilhasandClaude Opus 5
418729a470
Off unless ALLOW_ANY_ORIGIN_MUSIC=true, so it is opt-in per host and reverting is an env edit rather than a deploy. Set on this host now; the flag and the two call sites come out when the tailnet becomes the perimeter and the music app stops needing to be public. It drops one layer, not the lock: /api/music still requires a valid token through userMiddleware, and the non-owner account backstop in originScopeMiddleware still confines music accounts to /api/auth + /api/music whatever Origin they claim. Worth being plain about what is lost — Origin was never authentication here. `officer://<hex>` is chosen by the client, trivially forged outside a browser, and extractable from any shipped app binary. It is defence in depth, and this removes it for one path prefix. Two gates had to know: userMiddleware, which is what actually 403s, and the CORS origin callback, which would otherwise echo an empty origin and block a browser client that userMiddleware had already allowed through. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>