From f3d91ec771b19bc577da6013d8dbf21d63e085fd Mon Sep 17 00:00:00 2001
From: Rodrigo Patote <47055922+patote85@users.noreply.github.com>
Date: Thu, 24 Sep 2026 08:02:47 -0300
Subject: [PATCH] agent-friendly L2-5: CI ban CORS AllowOrigins *
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add tests/test_cdk_cors_ban.py — fails if cdk/**/*.py contains '*' string literal.
Covered by make check / CI pytest tests/.
---
 tests/test_cdk_cors_ban.py | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 tests/test_cdk_cors_ban.py

diff --git a/tests/test_cdk_cors_ban.py b/tests/test_cdk_cors_ban.py
new file mode 100644
index 0000000..a34a8b7
--- /dev/null
+++ b/tests/test_cdk_cors_ban.py
@@ -0,0 +1,28 @@
+"""Mechanical ban: CDK sources must not contain CORS origin wildcard *."""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+CDK_DIR = ROOT / "cdk"
+
+# Literal "*" / '*' as a Python string (CORS AllowOrigins wildcard).
+_STAR_STRING = re.compile(r"""(['"])\*\1""")
+
+
+def test_cdk_no_cors_allow_origins_star():
+    """Fail if cdk/ contains AllowOrigins / origin list wildcard '*'."""
+    offenders: list[str] = []
+    for path in sorted(CDK_DIR.rglob("*.py")):
+        for i, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
+            # Skip pure comments
+            code = line.split("#", 1)[0]
+            if _STAR_STRING.search(code):
+                offenders.append(f"{path.relative_to(ROOT)}:{i}: {line.strip()}")
+
+    assert not offenders, (
+        "CDK must not use CORS AllowOrigins '*'. Offenders:\n"
+        + "\n".join(offenders)
+    )