examples: drop redundant WithPermissiveOriginCheck in dev branches (#483)

cmd/site/main.go

@@ -181,8 +181,8 @@ func main() {
 	// Production options: AnonymousAuthenticator (default — per-browser
 	// session group), explicit origin allowlist for the docs deploy
 	// targets. The handler package's Handler signature accepts opts so
-	// the e2e test-server (docs/e2e/patterns/main.go) can supply
-	// WithPermissiveOriginCheck for random-port test setups.
+	// the e2e test-server can run in dev mode (WithDevMode(true)), which
+	// relaxes the origin check for random-port test setups.
 	mux.Handle("/apps/ui-patterns/", http.StripPrefix("/apps/ui-patterns", patterns.Handler("/apps/ui-patterns",
 		livetemplate.WithAuthenticator(&livetemplate.AnonymousAuthenticator{}),
 		livetemplate.WithAllowedOrigins(allowedOrigins),

examples/counter-basic/cmd/main.go

@@ -39,10 +39,9 @@ func main() {
 
 	var opts []livetemplate.Option
 	if *dev || os.Getenv("LVT_DEV_MODE") == "true" {
-		opts = append(opts,
-			livetemplate.WithDevMode(true),
-			livetemplate.WithPermissiveOriginCheck(),
-		)
+		// Dev mode also relaxes the WebSocket origin check (allows all
+		// origins), so localhost on any port works during development.
+		opts = append(opts, livetemplate.WithDevMode(true))
 	} else {
 		opts = append(opts, livetemplate.WithAllowedOrigins([]string{
 			"https://livetemplate.fly.dev",

examples/counter/cmd/main.go

@@ -39,10 +39,9 @@ func main() {
 
 	var opts []livetemplate.Option
 	if *dev || os.Getenv("LVT_DEV_MODE") == "true" {
-		opts = append(opts,
-			livetemplate.WithDevMode(true),
-			livetemplate.WithPermissiveOriginCheck(),
-		)
+		// Dev mode also relaxes the WebSocket origin check (allows all
+		// origins), so localhost on any port works during development.
+		opts = append(opts, livetemplate.WithDevMode(true))
 	} else {
 		opts = append(opts, livetemplate.WithAllowedOrigins([]string{
 			"https://livetemplate.fly.dev",

examples/live-dashboard/cmd/main.go

@@ -33,10 +33,9 @@ func main() {
 
 	var opts []livetemplate.Option
 	if *dev || os.Getenv("LVT_DEV_MODE") == "true" {
-		opts = append(opts,
-			livetemplate.WithDevMode(true),
-			livetemplate.WithPermissiveOriginCheck(),
-		)
+		// Dev mode also relaxes the WebSocket origin check (allows all
+		// origins), so localhost on any port works during development.
+		opts = append(opts, livetemplate.WithDevMode(true))
 	} else {
 		opts = append(opts, livetemplate.WithAllowedOrigins([]string{
 			"https://livetemplate.fly.dev",

examples/live-dashboard/dashboard_test.go

@@ -44,8 +44,7 @@ func TestMain(m *testing.M) {
 // carries the metrics markup — no Chrome required, so it runs in -short.
 func TestLiveDashboard_SmokeHTTP(t *testing.T) {
 	handler := livedashboard.Handler(
-		livetemplate.WithDevMode(true),
-		livetemplate.WithPermissiveOriginCheck(),
+		livetemplate.WithDevMode(true), // also relaxes the WS origin check
 	)
 	srv := httptest.NewServer(handler)
 	defer srv.Close()

examples/login/cmd/main.go

@@ -52,10 +52,9 @@ func main() {
 
 	var opts []livetemplate.Option
 	if *dev || os.Getenv("LVT_DEV_MODE") == "true" {
-		opts = append(opts,
-			livetemplate.WithDevMode(true),
-			livetemplate.WithPermissiveOriginCheck(),
-		)
+		// Dev mode also relaxes the WebSocket origin check (allows all
+		// origins), so localhost on any port works during development.
+		opts = append(opts, livetemplate.WithDevMode(true))
 	} else {
 		opts = append(opts, livetemplate.WithAllowedOrigins([]string{
 			"https://livetemplate.fly.dev",

examples/login/handler.go

@@ -77,8 +77,8 @@ func extractTemplate() string {
 // sees the request URL.
 //
 // Production callers (cmd/site) supply WithAllowedOrigins; test-server
-// callers (docs/e2e/login) supply WithDevMode + WithPermissiveOriginCheck
-// for random-port test setups.
+// callers run in dev mode (WithDevMode(true)), which relaxes the origin
+// check so random test ports work.
 func Handler(mountPath string, opts ...livetemplate.Option) http.Handler {
 	if mountPath == "" {
 		mountPath = "/"

examples/patterns/cmd/main.go

@@ -47,10 +47,9 @@ func main() {
 
 	var opts []livetemplate.Option
 	if *dev || os.Getenv("LVT_DEV_MODE") == "true" {
-		opts = append(opts,
-			livetemplate.WithDevMode(true),
-			livetemplate.WithPermissiveOriginCheck(),
-		)
+		// Dev mode also relaxes the WebSocket origin check (allows all
+		// origins), so localhost on any port works during development.
+		opts = append(opts, livetemplate.WithDevMode(true))
 	} else {
 		opts = append(opts, livetemplate.WithAllowedOrigins([]string{
 			"https://livetemplate.fly.dev",

examples/patterns/handler.go

@@ -81,7 +81,7 @@ var (
 // Pass extra livetemplate.Options as opts — these are appended to
 // every internal template construction. Production callers (cmd/site)
 // supply WithAuthenticator + WithAllowedOrigins; test-server callers
-// (docs/e2e/patterns/main.go) supply WithPermissiveOriginCheck so
+// run in dev mode (WithDevMode(true)), which relaxes the origin check so
 // random per-test ports work over the WS upgrade.
 //
 // Why options aren't hardcoded here: production wants strict origin

examples/progressive-enhancement/cmd/main.go

@@ -51,10 +51,9 @@ func main() {
 
 	var baseOpts []livetemplate.Option
 	if *dev || os.Getenv("LVT_DEV_MODE") == "true" {
-		baseOpts = append(baseOpts,
-			livetemplate.WithDevMode(true),
-			livetemplate.WithPermissiveOriginCheck(),
-		)
+		// Dev mode also relaxes the WebSocket origin check (allows all
+		// origins), so localhost on any port works during development.
+		baseOpts = append(baseOpts, livetemplate.WithDevMode(true))
 	} else {
 		baseOpts = append(baseOpts, livetemplate.WithAllowedOrigins([]string{
 			"https://livetemplate.fly.dev",

examples/progressive-enhancement/handler.go

@@ -71,8 +71,8 @@ func extractTemplate() string {
 // Handler returns the progressive-enhancement app as an http.Handler
 // ready to mount. Production callers (cmd/site) supply
 // WithAllowedOrigins (and optionally WithWebSocketDisabled for the
-// Tier B mount). Test-server callers supply WithDevMode +
-// WithPermissiveOriginCheck for random-port setups.
+// Tier B mount). Test-server callers run in dev mode (WithDevMode(true)),
+// which relaxes the origin check for random-port setups.
 func Handler(opts ...livetemplate.Option) http.Handler {
 	controller := &TodoController{validate: validator.New()}
 	initialState := &TodoState{}

examples/redacted-form/cmd/main.go

@@ -35,10 +35,9 @@ func main() {
 
 	var opts []livetemplate.Option
 	if *dev || os.Getenv("LVT_DEV_MODE") == "true" {
-		opts = append(opts,
-			livetemplate.WithDevMode(true),
-			livetemplate.WithPermissiveOriginCheck(),
-		)
+		// Dev mode also relaxes the WebSocket origin check (allows all
+		// origins), so localhost on any port works during development.
+		opts = append(opts, livetemplate.WithDevMode(true))
 	} else {
 		opts = append(opts, livetemplate.WithAllowedOrigins([]string{
 			"https://livetemplate.fly.dev",

examples/redacted-form/redacted_form_test.go

@@ -91,8 +91,7 @@ func startServer(t *testing.T, clientJS, clientCSS string) (int, func()) {
 
 	mux := http.NewServeMux()
 	mux.Handle("/", redactedform.LiveHandler(
-		livetemplate.WithDevMode(true),
-		livetemplate.WithPermissiveOriginCheck(),
+		livetemplate.WithDevMode(true), // also relaxes the WS origin check
 	))
 	mux.HandleFunc("/livetemplate-client.js", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/javascript")

examples/seat-picker/cmd/main.go

@@ -38,10 +38,9 @@ func main() {
 
 	var opts []livetemplate.Option
 	if *dev || os.Getenv("LVT_DEV_MODE") == "true" {
-		opts = append(opts,
-			livetemplate.WithDevMode(true),
-			livetemplate.WithPermissiveOriginCheck(),
-		)
+		// Dev mode also relaxes the WebSocket origin check (allows all
+		// origins), so localhost on any port works during development.
+		opts = append(opts, livetemplate.WithDevMode(true))
 	} else {
 		opts = append(opts, livetemplate.WithAllowedOrigins([]string{
 			"https://livetemplate.fly.dev",

examples/shared-notepad/cmd/main.go

@@ -42,10 +42,9 @@ func main() {
 		livetemplate.WithAuthenticator(notepad.NewDemoBasicAuth()),
 	}
 	if *dev || os.Getenv("LVT_DEV_MODE") == "true" {
-		opts = append(opts,
-			livetemplate.WithDevMode(true),
-			livetemplate.WithPermissiveOriginCheck(),
-		)
+		// Dev mode also relaxes the WebSocket origin check (allows all
+		// origins), so localhost on any port works during development.
+		opts = append(opts, livetemplate.WithDevMode(true))
 	} else {
 		opts = append(opts, livetemplate.WithAllowedOrigins([]string{
 			"https://livetemplate.fly.dev",

examples/todos/cmd/main.go

@@ -42,10 +42,9 @@ func main() {
 
 	var opts []livetemplate.Option
 	if *dev || os.Getenv("LVT_DEV_MODE") == "true" {
-		opts = append(opts,
-			livetemplate.WithDevMode(true),
-			livetemplate.WithPermissiveOriginCheck(),
-		)
+		// Dev mode also relaxes the WebSocket origin check (allows all
+		// origins), so localhost on any port works during development.
+		opts = append(opts, livetemplate.WithDevMode(true))
 	} else {
 		opts = append(opts, livetemplate.WithAllowedOrigins([]string{
 			"https://livetemplate.fly.dev",

examples/todos/handler.go

@@ -78,8 +78,8 @@ func extractTemplate() string {
 // hrefs that must resolve to the live mount prefix).
 //
 // Production callers (cmd/site) supply WithAllowedOrigins; test-server
-// callers supply WithPermissiveOriginCheck + WithDevMode for random-port
-// setups.
+// callers run in dev mode (WithDevMode(true)), which relaxes the origin
+// check for random-port setups.
 //
 // Calling Handler more than once returns the same first-call handler
 // (handlerOnce); the package-level state (DB, template) is one-shot