fix(platform): DSPX-4207 align server.cors defaults with OpenTDF platform config

[jp-ayyappan]

What

Update the platform chart's default server.cors values to match the OpenTDF platform's built-in CORS defaults:

• allowedmethods: add PATCH → GET, POST, PATCH, PUT, DELETE, OPTIONS
• allowedheaders: expand to Accept, Accept-Encoding, Authorization, Connect-Protocol-Version, Content-Length, Content-Type, Dpop, X-CSRF-Token, X-Requested-With, X-Rewrap-Additional-Context

README.md regenerated via helm-docs (also picks up the stale 0.15.0 version badge).

Why

The chart's default allowedheaders/allowedmethods had drifted from the platform binary's own defaults. In particular the chart was missing X-Rewrap-Additional-Context (and other browser headers), which the platform ships by default.

Source of truth for the new defaults:

• service/internal/server/server.go (AllowedHeaders/AllowedMethods struct defaults)
• opentdf-example.yaml server.cors

This lets browser clients such as the Virtru DSP Secure Viewer get working CORS from the chart defaults, so downstream charts no longer need to re-declare the entire server.cors block.

Notes

• No Chart.yaml/CHANGELOG.md bump — release-please owns versioning.
• server.cors.enabled default is unchanged (false); enabling CORS and setting allowedorigins remains a per-deployment concern.

Related

• Replaces the downstream workaround in virtru-corp/charts#237 (per review feedback to make this an opentdf chart change).
• Docs/sample-values context: virtru-corp/dsp-bundle#288, virtru-corp/data-security-platform#3528.

Summary by CodeRabbit

• Enhancements
  • Expanded cross-origin request support with additional permitted headers.
  • Added support for PATCH requests.
  • Updated the platform chart version badge to 0.15.0.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 43350fa2-9183-43be-9899-0db13ea2cd19

📥 Commits

Reviewing files that changed from the base of the PR and between 6b3e495 and 245cbbf.

📒 Files selected for processing (2)

• charts/platform/README.md
• charts/platform/values.yaml

---

📝 Walkthrough

Walkthrough

The platform Helm chart now allows PATCH requests and expands its default CORS request headers. The README reflects these defaults and updates the chart version badge from 0.14.0 to 0.15.0.

Changes

Platform chart CORS

Layer / File(s)	Summary
Update CORS defaults and chart metadata charts/platform/values.yaml, charts/platform/README.md	The chart adds PATCH and several allowed request headers, removes X-Request-ID, and updates the chart version badge.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: eastokes

Poem

A rabbit checks the headers bright,
Adds PATCH to the path tonight.
Old IDs hop away,
New CORS fields join the array,
The chart badge shines at 0.15.0.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes aligning the platform chart's server.cors defaults with the OpenTDF platform configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch DSPX-4207-platform-cors-secure-viewer

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}