Keep mixed listener CORS policy authoritative

[Ri-go]

The mixed gRPC-Web listener now keeps its configured CORS policy when REST or gRPC backends send conflicting headers. Responses return one allowed origin, discard upstream CORS permissions, and preserve streaming, trailers and unrelated headers.

Validated with the full test suite, vet, lint and focused race tests. New regressions cover REST, native gRPC over h2c, binary/text gRPC-Web, denied origins and streamed responses.

Summary by CodeRabbit

• Bug Fixes
  • Enforced configured cross-origin access policies consistently across REST, native gRPC, and gRPC-Web requests.
  • Blocked requests from disallowed origins before they reach backend services.
  • Prevented upstream responses from overriding configured CORS policies.
  • Preserved non-CORS headers, streaming responses, trailers, and error handling while applying CORS rules.
  • Improved handling of wildcard origins, missing origins, and late response header updates.

[linear]

ID-1610

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Essentials

Run ID: ac6592a6-bff1-4b45-bfd5-e353e37caafd

📥 Commits

Reviewing files that changed from the base of the PR and between 7ce8d4e and f2f3ddd.

📒 Files selected for processing (4)

• internal/server/cosmos_grpc/web.go
• internal/server/cosmos_grpc/web_cors.go
• internal/server/cosmos_grpc/web_cors_test.go
• internal/server/cosmos_grpc/web_test.go

 ____________________________________________________________
< To iterate is human, to recurse divine. - L. Peter Deutsch >
 ------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}