feat(cas): add configurable CORS headers to HTTP download endpoint

The platform frontend needs to fetch() content from CAS signed URLs to
render evidence inline (SBOMs, SARIF, etc.). Currently browsers block
these requests because the CAS HTTP endpoint returns no CORS headers.

Add a configurable CORS middleware that sits outside auth so OPTIONS
preflights are handled before token validation. Exposed via Helm chart
as cas.allowedOrigins (supports both YAML list and comma-separated
string). When empty (default), CORS is disabled and the middleware is
a passthrough.

Closes #2848

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

app/artifact-cas/configs/config.devel.yaml

@@ -8,6 +8,9 @@ server:
     # Timeouts for http downloads
     # grpc downloads/uploads don't require this because they don't have timeouts
     timeout: 300s
+    # cors:
+    #   allow_origins:
+    #     - "http://localhost:3000"
   grpc:
     addr: 0.0.0.0:9001
     # Some unary RPCs are slow, so we need to increase the timeout

app/artifact-cas/internal/conf/conf.pb.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -42,6 +42,10 @@ message Server {
     string network = 1;
     string addr = 2;
     google.protobuf.Duration timeout = 3;
+    CORS cors = 4;
+  }
+  message CORS {
+    repeated string allow_origins = 1;
   }
   message TLS {
     // path to certificate and private key

app/artifact-cas/internal/conf/conf.proto

@@ -0,0 +1,76 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package server
+
+import "net/http"
+
+// CORSMiddleware returns an http.Handler that applies CORS headers based on allowedOrigins.
+// If allowedOrigins is empty, the middleware is a passthrough (CORS disabled).
+// If "*" is in the list, any origin is allowed.
+// Otherwise, only origins in the list are echoed back.
+// OPTIONS preflight requests are short-circuited with 204 No Content before reaching the next handler.
+func CORSMiddleware(allowedOrigins []string, next http.Handler) http.Handler {
+	if len(allowedOrigins) == 0 {
+		return next
+	}
+
+	wildcard := false
+	allowed := make(map[string]struct{}, len(allowedOrigins))
+	for _, o := range allowedOrigins {
+		if o == "*" {
+			wildcard = true
+		}
+		allowed[o] = struct{}{}
+	}
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		origin := r.Header.Get("Origin")
+		if origin == "" {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		var matchedOrigin string
+		switch {
+		case wildcard:
+			matchedOrigin = "*"
+		default:
+			if _, ok := allowed[origin]; ok {
+				matchedOrigin = origin
+			}
+		}
+
+		if matchedOrigin == "" {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		w.Header().Set("Access-Control-Allow-Origin", matchedOrigin)
+		if matchedOrigin != "*" {
+			w.Header().Set("Vary", "Origin")
+		}
+
+		if r.Method == http.MethodOptions {
+			w.Header().Set("Access-Control-Allow-Methods", "GET, HEAD, OPTIONS")
+			w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type")
+			w.Header().Set("Access-Control-Max-Age", "86400")
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}