feat: centralize DeepSeek SSE parsing, improve account identifier resolution, and simplify CORS configuration.

This commit is contained in:
CJACK
2026-02-17 03:45:55 +08:00
parent 2cde0a1d84
commit 23d5ac7fa2
12 changed files with 263 additions and 75 deletions

View File

@@ -90,18 +90,7 @@ func timeout(d time.Duration) func(http.Handler) http.Handler {
func cors(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
origin := r.Header.Get("Origin")
if origin != "" {
// Dynamically reflect the request origin to allow credentials.
// Using "*" with Access-Control-Allow-Credentials: true is
// invalid per the CORS spec and will be rejected by browsers.
w.Header().Set("Access-Control-Allow-Origin", origin)
w.Header().Set("Access-Control-Allow-Credentials", "true")
w.Header().Set("Vary", "Origin")
} else {
// No Origin header (e.g. server-to-server requests); allow all.
w.Header().Set("Access-Control-Allow-Origin", "*")
}
w.Header().Set("Access-Control-Allow-Origin", "*")
w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS, PUT, DELETE")
w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
if r.Method == http.MethodOptions {