Feng Ruohang 632eb4729a refactor: serve non-resident buckets with the global CORS policy ...

The pre-authentication CORS lookup stays resident-only, so client-supplied
path segments still cause no metadata I/O and no cache growth. The
fail-closed states for startup, load failures, and the internal namespace
are gone: CORS is a browser response policy rather than an authorization
boundary, and failing closed only denied browser clients CORS headers while
bucket metadata was still loading. A bucket whose stored CORS document does
not parse still gets no CORS headers. This removes the loadFailed bookkeeping
and the unused GetCorsConfig, HasAllowedOrigin, and generic Update path for
CORS; tests use the CORS-specific writer.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PvgysXDmhPBBimCReYtA8q
Signed-off-by: Feng Ruohang <rh@vonng.com>

2026-09-02 14:06:56 +08:00

..

bandwidth

Use new gofumpt (#21613)

2025-09-28 13:59:21 -07:00

cors

refactor: serve non-resident buckets with the global CORS policy

2026-09-02 14:06:56 +08:00

encryption

remove gateway completely (#15929)

2022-10-24 17:44:15 -07:00

lifecycle

build: regenerate and verify all generated outputs

2026-08-04 23:02:16 +08:00

object/lock

fix: harden CORS and replication request trust

2026-09-01 20:50:08 +08:00

replication

Use new gofumpt (#21613)

2025-09-28 13:59:21 -07:00

versioning

Run modernize (#21546)

2025-08-28 19:39:48 -07:00