🛡️ Sentinel: [HIGH] Fix Missing CORS Middleware on Authenticated Endpoints

[jackby03]

🚨 Severity: HIGH
💡 Vulnerability: The CORS middleware was previously applied on a per-route basis, but an explicit OPTIONS route was only registered for the unauthenticated /api/v1/auth/login endpoint. Because Go 1.22's http.ServeMux enforces strict method matching, preflight OPTIONS requests to all other protected endpoints (e.g., config, firewall rules, marketplace) were rejected by the router with a 405 Method Not Allowed, breaking cross-origin API interactions for authenticated clients.
🎯 Impact: Prevents web browsers from successfully making authenticated API requests from different origins, breaking the Dashboard UI and other legitimate web consumers.
🔧 Fix: Refactored corsMiddleware in internal/api/middleware.go to accept an http.Handler instead of http.HandlerFunc. Applied this middleware globally by wrapping the main ServeMux inside Server.Handler(). Removed the redundant withCORS wrappers and the explicit OPTIONS route from internal/api/routes.go.
✅ Verification: Ran npm i && npm run build in ui/, verified with CGO_ENABLED=0 go test ./... and golangci-lint run ./.... Tests passed, confirming the global middleware correctly handles preflight requests across the entire API surface.

---

PR created automatically by Jules for task 17668092997832558884 started by @jackby03

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.