feat: add (hardcoded) cors headers

Cargo.toml

@@ -25,7 +25,7 @@ serde = "1.0.195"
 serde_derive = "1.0.195"
 thiserror = "1.0.56"
 tokio = { version = "1.35.1", features = ["full"] }
-tower-http = { version = "0.5.1", features = ["trace", "limit"] }
+tower-http = { version = "0.5.1", features = ["trace", "limit", "cors"] }
 tracing = "0.1.40"
 tracing-subscriber = { version = "0.3.18", features = ["env-filter"] }
 serde_json = "1.0.111"

src/api/mod.rs

@@ -7,7 +7,7 @@ use axum::{
 use std::sync::Arc;
 use std::time::Duration;
 use tower_governor::{governor::GovernorConfigBuilder, GovernorLayer};
-use tower_http::{limit::RequestBodyLimitLayer, trace::TraceLayer};
+use tower_http::{limit::RequestBodyLimitLayer, trace::TraceLayer, cors::CorsLayer};
 
 pub mod invoices;
 
@@ -28,10 +28,17 @@ pub fn app() -> Router<crate::state::State> {
         governor_limiter.retain_recent();
     });
 
+    let cors_layer = CorsLayer::new()
+        .allow_origin([
+            "https://tietokilta.fi".parse().unwrap(),
+            "http://localhost:3000".parse().unwrap(),
+        ]);
+
     Router::new()
         .route("/health", get(health))
         .route("/invoices", post(invoices::create))
         .layer(TraceLayer::new_for_http())
+        .layer(cors_layer)
         .layer(DefaultBodyLimit::disable())
         // Limit the body to 24 MiB since the email is limited to 25 MiB
         .layer(RequestBodyLimitLayer::new(24 * 1024 * 1024))