From c47f12d2547deb3b5a5c684b6aebb86f816426bc Mon Sep 17 00:00:00 2001 From: Adnaan Badr Date: Sun, 12 Jul 2026 14:21:39 +0000 Subject: [PATCH] examples: drop redundant WithPermissiveOriginCheck in dev branches (#483) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit WithDevMode(true) already relaxes the WebSocket origin check to allow all origins (see livetemplate#487), so pairing it with WithPermissiveOriginCheck() in the dev branch is redundant. Collapse every example's dev branch to a single WithDevMode(true) call with a comment noting it also relaxes the origin check — so a reader copying the example sees the minimal, correct dev setup. Also drop the redundant paired call from the two test files that built their own options (live-dashboard, redacted-form), and refresh the four handler.go "test-server callers" comments + cmd/site's to describe the mechanism as running in dev mode (which relaxes the origin check) rather than supplying WithPermissiveOriginCheck. Those comments also cited stale e2e paths (docs/e2e/login, docs/e2e/patterns/main.go) that no longer exist — the real test-server callers are the examples' own _test.go files, which run the app with LVT_DEV_MODE=true via e2etest.StartTestServer. Relies only on already-released livetemplate v0.18.0 runtime behavior. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_015ZgmyffUen38oazb39RhSk --- cmd/site/main.go | 4 ++-- examples/counter-basic/cmd/main.go | 7 +++---- examples/counter/cmd/main.go | 7 +++---- examples/live-dashboard/cmd/main.go | 7 +++---- examples/live-dashboard/dashboard_test.go | 3 +-- examples/login/cmd/main.go | 7 +++---- examples/login/handler.go | 4 ++-- examples/patterns/cmd/main.go | 7 +++---- examples/patterns/handler.go | 2 +- examples/progressive-enhancement/cmd/main.go | 7 +++---- examples/progressive-enhancement/handler.go | 4 ++-- examples/redacted-form/cmd/main.go | 7 +++---- examples/redacted-form/redacted_form_test.go | 3 +-- examples/seat-picker/cmd/main.go | 7 +++---- examples/shared-notepad/cmd/main.go | 7 +++---- examples/todos/cmd/main.go | 7 +++---- examples/todos/handler.go | 4 ++-- 17 files changed, 41 insertions(+), 53 deletions(-) diff --git a/cmd/site/main.go b/cmd/site/main.go index ab94898..d323d8b 100644 --- a/cmd/site/main.go +++ b/cmd/site/main.go @@ -181,8 +181,8 @@ func main() { // Production options: AnonymousAuthenticator (default — per-browser // session group), explicit origin allowlist for the docs deploy // targets. The handler package's Handler signature accepts opts so - // the e2e test-server (docs/e2e/patterns/main.go) can supply - // WithPermissiveOriginCheck for random-port test setups. + // the e2e test-server can run in dev mode (WithDevMode(true)), which + // relaxes the origin check for random-port test setups. mux.Handle("/apps/ui-patterns/", http.StripPrefix("/apps/ui-patterns", patterns.Handler("/apps/ui-patterns", livetemplate.WithAuthenticator(&livetemplate.AnonymousAuthenticator{}), livetemplate.WithAllowedOrigins(allowedOrigins), diff --git a/examples/counter-basic/cmd/main.go b/examples/counter-basic/cmd/main.go index 130d01c..12cf4af 100644 --- a/examples/counter-basic/cmd/main.go +++ b/examples/counter-basic/cmd/main.go @@ -39,10 +39,9 @@ func main() { var opts []livetemplate.Option if *dev || os.Getenv("LVT_DEV_MODE") == "true" { - opts = append(opts, - livetemplate.WithDevMode(true), - livetemplate.WithPermissiveOriginCheck(), - ) + // Dev mode also relaxes the WebSocket origin check (allows all + // origins), so localhost on any port works during development. + opts = append(opts, livetemplate.WithDevMode(true)) } else { opts = append(opts, livetemplate.WithAllowedOrigins([]string{ "https://livetemplate.fly.dev", diff --git a/examples/counter/cmd/main.go b/examples/counter/cmd/main.go index 4866b15..531203f 100644 --- a/examples/counter/cmd/main.go +++ b/examples/counter/cmd/main.go @@ -39,10 +39,9 @@ func main() { var opts []livetemplate.Option if *dev || os.Getenv("LVT_DEV_MODE") == "true" { - opts = append(opts, - livetemplate.WithDevMode(true), - livetemplate.WithPermissiveOriginCheck(), - ) + // Dev mode also relaxes the WebSocket origin check (allows all + // origins), so localhost on any port works during development. + opts = append(opts, livetemplate.WithDevMode(true)) } else { opts = append(opts, livetemplate.WithAllowedOrigins([]string{ "https://livetemplate.fly.dev", diff --git a/examples/live-dashboard/cmd/main.go b/examples/live-dashboard/cmd/main.go index 0e0278c..56b8871 100644 --- a/examples/live-dashboard/cmd/main.go +++ b/examples/live-dashboard/cmd/main.go @@ -33,10 +33,9 @@ func main() { var opts []livetemplate.Option if *dev || os.Getenv("LVT_DEV_MODE") == "true" { - opts = append(opts, - livetemplate.WithDevMode(true), - livetemplate.WithPermissiveOriginCheck(), - ) + // Dev mode also relaxes the WebSocket origin check (allows all + // origins), so localhost on any port works during development. + opts = append(opts, livetemplate.WithDevMode(true)) } else { opts = append(opts, livetemplate.WithAllowedOrigins([]string{ "https://livetemplate.fly.dev", diff --git a/examples/live-dashboard/dashboard_test.go b/examples/live-dashboard/dashboard_test.go index f07fb95..c54770c 100644 --- a/examples/live-dashboard/dashboard_test.go +++ b/examples/live-dashboard/dashboard_test.go @@ -44,8 +44,7 @@ func TestMain(m *testing.M) { // carries the metrics markup — no Chrome required, so it runs in -short. func TestLiveDashboard_SmokeHTTP(t *testing.T) { handler := livedashboard.Handler( - livetemplate.WithDevMode(true), - livetemplate.WithPermissiveOriginCheck(), + livetemplate.WithDevMode(true), // also relaxes the WS origin check ) srv := httptest.NewServer(handler) defer srv.Close() diff --git a/examples/login/cmd/main.go b/examples/login/cmd/main.go index 40efa22..c8b726c 100644 --- a/examples/login/cmd/main.go +++ b/examples/login/cmd/main.go @@ -52,10 +52,9 @@ func main() { var opts []livetemplate.Option if *dev || os.Getenv("LVT_DEV_MODE") == "true" { - opts = append(opts, - livetemplate.WithDevMode(true), - livetemplate.WithPermissiveOriginCheck(), - ) + // Dev mode also relaxes the WebSocket origin check (allows all + // origins), so localhost on any port works during development. + opts = append(opts, livetemplate.WithDevMode(true)) } else { opts = append(opts, livetemplate.WithAllowedOrigins([]string{ "https://livetemplate.fly.dev", diff --git a/examples/login/handler.go b/examples/login/handler.go index d76fe0e..95b6f4f 100644 --- a/examples/login/handler.go +++ b/examples/login/handler.go @@ -77,8 +77,8 @@ func extractTemplate() string { // sees the request URL. // // Production callers (cmd/site) supply WithAllowedOrigins; test-server -// callers (docs/e2e/login) supply WithDevMode + WithPermissiveOriginCheck -// for random-port test setups. +// callers run in dev mode (WithDevMode(true)), which relaxes the origin +// check so random test ports work. func Handler(mountPath string, opts ...livetemplate.Option) http.Handler { if mountPath == "" { mountPath = "/" diff --git a/examples/patterns/cmd/main.go b/examples/patterns/cmd/main.go index 3895ec9..8fbfc9d 100644 --- a/examples/patterns/cmd/main.go +++ b/examples/patterns/cmd/main.go @@ -47,10 +47,9 @@ func main() { var opts []livetemplate.Option if *dev || os.Getenv("LVT_DEV_MODE") == "true" { - opts = append(opts, - livetemplate.WithDevMode(true), - livetemplate.WithPermissiveOriginCheck(), - ) + // Dev mode also relaxes the WebSocket origin check (allows all + // origins), so localhost on any port works during development. + opts = append(opts, livetemplate.WithDevMode(true)) } else { opts = append(opts, livetemplate.WithAllowedOrigins([]string{ "https://livetemplate.fly.dev", diff --git a/examples/patterns/handler.go b/examples/patterns/handler.go index 3933445..450a47d 100644 --- a/examples/patterns/handler.go +++ b/examples/patterns/handler.go @@ -81,7 +81,7 @@ var ( // Pass extra livetemplate.Options as opts — these are appended to // every internal template construction. Production callers (cmd/site) // supply WithAuthenticator + WithAllowedOrigins; test-server callers -// (docs/e2e/patterns/main.go) supply WithPermissiveOriginCheck so +// run in dev mode (WithDevMode(true)), which relaxes the origin check so // random per-test ports work over the WS upgrade. // // Why options aren't hardcoded here: production wants strict origin diff --git a/examples/progressive-enhancement/cmd/main.go b/examples/progressive-enhancement/cmd/main.go index 2d7660d..498b77b 100644 --- a/examples/progressive-enhancement/cmd/main.go +++ b/examples/progressive-enhancement/cmd/main.go @@ -51,10 +51,9 @@ func main() { var baseOpts []livetemplate.Option if *dev || os.Getenv("LVT_DEV_MODE") == "true" { - baseOpts = append(baseOpts, - livetemplate.WithDevMode(true), - livetemplate.WithPermissiveOriginCheck(), - ) + // Dev mode also relaxes the WebSocket origin check (allows all + // origins), so localhost on any port works during development. + baseOpts = append(baseOpts, livetemplate.WithDevMode(true)) } else { baseOpts = append(baseOpts, livetemplate.WithAllowedOrigins([]string{ "https://livetemplate.fly.dev", diff --git a/examples/progressive-enhancement/handler.go b/examples/progressive-enhancement/handler.go index 6e18c72..d0e95ae 100644 --- a/examples/progressive-enhancement/handler.go +++ b/examples/progressive-enhancement/handler.go @@ -71,8 +71,8 @@ func extractTemplate() string { // Handler returns the progressive-enhancement app as an http.Handler // ready to mount. Production callers (cmd/site) supply // WithAllowedOrigins (and optionally WithWebSocketDisabled for the -// Tier B mount). Test-server callers supply WithDevMode + -// WithPermissiveOriginCheck for random-port setups. +// Tier B mount). Test-server callers run in dev mode (WithDevMode(true)), +// which relaxes the origin check for random-port setups. func Handler(opts ...livetemplate.Option) http.Handler { controller := &TodoController{validate: validator.New()} initialState := &TodoState{} diff --git a/examples/redacted-form/cmd/main.go b/examples/redacted-form/cmd/main.go index 84b8c5f..2fad094 100644 --- a/examples/redacted-form/cmd/main.go +++ b/examples/redacted-form/cmd/main.go @@ -35,10 +35,9 @@ func main() { var opts []livetemplate.Option if *dev || os.Getenv("LVT_DEV_MODE") == "true" { - opts = append(opts, - livetemplate.WithDevMode(true), - livetemplate.WithPermissiveOriginCheck(), - ) + // Dev mode also relaxes the WebSocket origin check (allows all + // origins), so localhost on any port works during development. + opts = append(opts, livetemplate.WithDevMode(true)) } else { opts = append(opts, livetemplate.WithAllowedOrigins([]string{ "https://livetemplate.fly.dev", diff --git a/examples/redacted-form/redacted_form_test.go b/examples/redacted-form/redacted_form_test.go index 9f247b6..d937ffa 100644 --- a/examples/redacted-form/redacted_form_test.go +++ b/examples/redacted-form/redacted_form_test.go @@ -91,8 +91,7 @@ func startServer(t *testing.T, clientJS, clientCSS string) (int, func()) { mux := http.NewServeMux() mux.Handle("/", redactedform.LiveHandler( - livetemplate.WithDevMode(true), - livetemplate.WithPermissiveOriginCheck(), + livetemplate.WithDevMode(true), // also relaxes the WS origin check )) mux.HandleFunc("/livetemplate-client.js", func(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/javascript") diff --git a/examples/seat-picker/cmd/main.go b/examples/seat-picker/cmd/main.go index c7d8c4b..a7221f4 100644 --- a/examples/seat-picker/cmd/main.go +++ b/examples/seat-picker/cmd/main.go @@ -38,10 +38,9 @@ func main() { var opts []livetemplate.Option if *dev || os.Getenv("LVT_DEV_MODE") == "true" { - opts = append(opts, - livetemplate.WithDevMode(true), - livetemplate.WithPermissiveOriginCheck(), - ) + // Dev mode also relaxes the WebSocket origin check (allows all + // origins), so localhost on any port works during development. + opts = append(opts, livetemplate.WithDevMode(true)) } else { opts = append(opts, livetemplate.WithAllowedOrigins([]string{ "https://livetemplate.fly.dev", diff --git a/examples/shared-notepad/cmd/main.go b/examples/shared-notepad/cmd/main.go index bfdf1ed..2faf2de 100644 --- a/examples/shared-notepad/cmd/main.go +++ b/examples/shared-notepad/cmd/main.go @@ -42,10 +42,9 @@ func main() { livetemplate.WithAuthenticator(notepad.NewDemoBasicAuth()), } if *dev || os.Getenv("LVT_DEV_MODE") == "true" { - opts = append(opts, - livetemplate.WithDevMode(true), - livetemplate.WithPermissiveOriginCheck(), - ) + // Dev mode also relaxes the WebSocket origin check (allows all + // origins), so localhost on any port works during development. + opts = append(opts, livetemplate.WithDevMode(true)) } else { opts = append(opts, livetemplate.WithAllowedOrigins([]string{ "https://livetemplate.fly.dev", diff --git a/examples/todos/cmd/main.go b/examples/todos/cmd/main.go index 187b24f..1185449 100644 --- a/examples/todos/cmd/main.go +++ b/examples/todos/cmd/main.go @@ -42,10 +42,9 @@ func main() { var opts []livetemplate.Option if *dev || os.Getenv("LVT_DEV_MODE") == "true" { - opts = append(opts, - livetemplate.WithDevMode(true), - livetemplate.WithPermissiveOriginCheck(), - ) + // Dev mode also relaxes the WebSocket origin check (allows all + // origins), so localhost on any port works during development. + opts = append(opts, livetemplate.WithDevMode(true)) } else { opts = append(opts, livetemplate.WithAllowedOrigins([]string{ "https://livetemplate.fly.dev", diff --git a/examples/todos/handler.go b/examples/todos/handler.go index 799b27b..f78687c 100644 --- a/examples/todos/handler.go +++ b/examples/todos/handler.go @@ -78,8 +78,8 @@ func extractTemplate() string { // hrefs that must resolve to the live mount prefix). // // Production callers (cmd/site) supply WithAllowedOrigins; test-server -// callers supply WithPermissiveOriginCheck + WithDevMode for random-port -// setups. +// callers run in dev mode (WithDevMode(true)), which relaxes the origin +// check for random-port setups. // // Calling Handler more than once returns the same first-call handler // (handlerOnce); the package-level state (DB, template) is one-shot