feat: ship a web app (#218)

* feat(orion): add endpoint for link metadata

* refactor: cleanup comments

* wip: plumbing for building a web app

* setup deployment materials for web app

* fix(web): favicon

go/cmd/orion/main.go

@@ -6,6 +6,7 @@ import (
 	"log/slog"
 	"net/http"
 	"os"
+	"strings"
 
 	"cloud.google.com/go/firestore"
 	"cloud.google.com/go/storage"
@@ -173,6 +174,9 @@ func main() {
 	// Particles
 	mux.Handle("GET /particles/{id}/download", withAuth(h.DownloadParticleMedia))
 
+	// Link metadata
+	mux.Handle("GET /metadata", withAuth(h.GetLinkMetadata))
+
 	// Depot
 	mux.Handle("POST /depot/upload", withAuth(h.PrepareUpload))
 	mux.Handle("POST /depot/objects/{id}/confirm", withAuth(h.ConfirmUpload))
@@ -185,8 +189,17 @@ func main() {
 	mux.Handle("GET /waitlist/{email}", withAuth(h.GetWaitlistEntry))
 	mux.Handle("POST /waitlist/invite", withAuth(h.InviteWaitlistEntrant))
 
-	// nil = allow all origins (Electron app needs it).
-	muxWithCors := middleware.CORS(nil)(mux)
+	// CORS_ALLOWED_ORIGINS is a comma-separated whitelist for the web client.
+	// Empty / unset = allow all
+	var allowedOrigins []string
+	if raw := os.Getenv("CORS_ALLOWED_ORIGINS"); raw != "" {
+		for _, o := range strings.Split(raw, ",") {
+			if o = strings.TrimSpace(o); o != "" {
+				allowedOrigins = append(allowedOrigins, o)
+			}
+		}
+	}
+	muxWithCors := middleware.CORS(allowedOrigins)(mux)
 
 	addr := fmt.Sprintf("0.0.0.0:%s", port)
 	slog.Info("running server", "addr", addr)