fix: correct CORS allowed-methods/headers defaults

[lesnik512]

Bug

settings.py defaulted the CORS lists to a single empty string:

cors_allowed_methods: list[str] = [""]
cors_allowed_headers: list[str] = [""]

[""] is neither "allow all" (["*"]) nor empty ([]). It flows through lite-bootstrap into Litestar's CORSConfig, which on preflight produces:

Access-Control-Allow-Methods: ''                                          ← empty
Access-Control-Allow-Headers: ', Accept, Accept-Language, Content-Language, Content-Type'   ← stray leading comma

is_allow_all_methods is "*" in [""] → False, but the list is non-empty, so Litestar emits ", ".join({""}) → the empty string.

Impact

A browser SPA at the configured dev origin http://localhost:5173 doing any preflighted request — every POST/PUT write endpoint with Content-Type: application/json — receives an empty Access-Control-Allow-Methods and the browser blocks the request. The template's default CORS was broken for the exact origin it ships with. (allowed_headers was functionally OK — Content-Type is covered by Litestar's defaults — but emitted a stray empty token.)

Fix

cors_allowed_methods: list[str] = ["*"]   # → DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
cors_allowed_headers: list[str] = ["*"]   # → allow-all, no stray token

Permissive dev defaults; tighten via env in prod.

Test (TDD — failing first)

tests/test_cors.py sends a preflight OPTIONS /api/decks/ (Origin: localhost:5173, Access-Control-Request-Method: POST) through the client fixture and asserts POST/PUT appear in Access-Control-Allow-Methods — exercising the real settings → bootstrap → middleware wiring.

• Before (RED): allow-methods is '' → POST absent → fails.
• After (GREEN): full method set → passes.

22 passed, 100% coverage.

🤖 Generated with Claude Code