http: add cors filtering

[jherrera-jump]

Adds option to allow operators to enable CORS filtering. Disabled by default.

[Copilot]

Pull request overview

This PR adds configurable CORS handling to Firedancer’s embedded HTTP server usage (GUI + metrics), including parsing the Origin request header, generating Access-Control-* response headers, and wiring an origin allowlist through config → topology → tiles.

Changes:

• Add CORS origin allowlist constants/util (fd_http_cors_match_origin) and parse the Origin request header in the HTTP server.
• Add per-tile access_control_allow_origin configuration for tiles.gui and tiles.metric, including OPTIONS preflight handling and emitting Allow / Vary: Origin.
• Update HTTP server footprint assertions in tests and propagate new config fields through topology setup.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/waltz/http/test_http_server.c	Updates expected server footprint values due to added server state/headers.
src/waltz/http/fd_http.h	Introduces CORS allowlist sizing constants and an origin matching helper.
src/waltz/http/fd_http_server.h	Extends request/response structs with Origin and Allow header support.
src/waltz/http/fd_http_server.c	Parses Origin, emits Allow, and adds Vary: Origin for non-wildcard CORS.
src/disco/topo/fd_topo.h	Adds CORS allowlist storage to GUI + metrics tile config in topology.
src/disco/metrics/fd_metric_tile.c	Implements metrics CORS allowlisting and OPTIONS preflight responses.
src/disco/gui/fd_gui_tile.c	Implements GUI CORS allowlisting and OPTIONS preflight responses.
src/app/shared/fd_config.h	Adds CORS allowlist fields to config structs for GUI + metrics tiles.
src/app/shared/fd_config_parse.c	Parses new TOML array config into *_cnt + fixed-size arrays.
src/app/firedancer/topology.c	Copies parsed allowlists into tile topology structs for Firedancer.
src/app/firedancer/config/default.toml	Documents and adds default access_control_allow_origin = [] for tiles.
src/app/fdctl/topology.c	Copies parsed allowlists into tile topology structs for fdctl.
src/app/fdctl/config/default.toml	Documents and adds default access_control_allow_origin = [] for tiles.

Comments suppressed due to low confidence (1)

src/disco/metrics/fd_metric_tile.c:96

• If an allowed Origin triggers a metrics request but staging the body fails, the 500 response should still carry Access-Control-Allow-Origin; otherwise browser clients can't read the error status due to CORS.

    if( FD_UNLIKELY( fd_http_server_stage_body( ctx->metrics_server, &response ) ) ) {
      FD_LOG_WARNING(( "fd_http_server_stage_body failed, metrics response too long" ));
      return (fd_http_server_response_t){
        .status = 500,
      };
    }

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.