corsMiddleware method
The CORS middleware for the Hub's allowed origins, or null when none are
configured (no browser client, nothing to allow).
Install it with OmnyServerHub.useOuter, not use — it has to sit
outside the error mapper to stamp a 401/404/500, which a browser can
otherwise not read at all, and outside authentication to answer a preflight,
which carries no credentials.
Credentials are not enabled: the dashboard authenticates with a bearer token in a header, not a cookie, so there is no reason to let the browser attach ambient credentials to a cross-origin call. That is also what makes anyOrigin tolerable — a wildcard lets any page call the API, but the browser attaches no ambient credentials, so it still needs a token it was given. It is a real widening all the same, and the Hub says so at startup.
anyOrigin is dominant: cors() only emits a literal * when no specific
origin is named, so '*' cannot be combined with an allow-list — asking for
both means asking for everything.
Implementation
Middleware? corsMiddleware() {
final origins = hub.config.corsOrigins;
if (origins.isEmpty) return null;
if (origins.any(isAnyOrigin)) return cors(allowAnyOrigin: true);
return cors(allowedOrigins: origins);
}