fix: render valid CORS Nginx directives

src/Cors/Origin.php

@@ -19,7 +19,7 @@ final class Origin
         $parts = parse_url($origin);
         if (false === $parts
             || !isset($parts['scheme'], $parts['host'])
-            || isset($parts['user'], $parts['pass'], $parts['query'], $parts['fragment'])
+            || isset($parts['user']) || isset($parts['pass']) || isset($parts['query']) || isset($parts['fragment'])
             || (isset($parts['path']) && '/' !== $parts['path'])
         ) {
             throw new InvalidArgumentException(sprintf('Invalid CORS origin: %s', $origin));

src/EventHandler/NginxConfiguration.php

@@ -56,8 +56,9 @@ final readonly class NginxConfiguration
             # The allowlist is emitted as exact Origin matches. Nginx omits an
             # add_header with an empty value, so missing/disallowed Origins do not
             # receive Access-Control-Allow-Origin. This applies after X-Accel.
-{$corsOriginRules}            add_header Access-Control-Allow-Origin $ondemand_hls_cors_origin always;
+        {$corsOriginRules}
-            add_header Vary $ondemand_hls_cors_vary always;
+            add_header Access-Control-Allow-Origin \$ondemand_hls_cors_origin always;
+            add_header Vary \$ondemand_hls_cors_vary always;
             add_header Cache-Control "private, no-store, max-age=0" always;
             add_header X-Content-Type-Options "nosniff" always;
             alias {$assetDirectory};

tests/Cors/OriginTest.php

@@ -22,11 +22,13 @@ final class OriginTest extends TestCase
     public function testItRejectsPathsAndUnsafeOriginForms(): void
     {
         foreach (['*', 'null', 'https://aifrequency.org/path', 'https://[email protected]', 'file:///tmp/a'] as $origin) {
+            $rejected = false;
             try {
                 Origin::normalize($origin);
-                self::fail(sprintf('%s should be rejected.', $origin));
             } catch (InvalidArgumentException) {
+                $rejected = true;
             }
+            self::assertTrue($rejected, sprintf('%s should be rejected.', $origin));
         }
     }
 }