feat: add configurable HLS CORS allowlists

src/EventHandler/NginxConfiguration.php

@@ -6,10 +6,15 @@ namespace Plugin\AzuraCastOnDemandHls\EventHandler;
 
 use App\Event\Nginx\WriteNginxConfiguration;
 use Plugin\AzuraCastOnDemandHls\Config;
+use Plugin\AzuraCastOnDemandHls\Cors\CorsConfigurationProvider;
+use Plugin\AzuraCastOnDemandHls\Cors\NginxRules;
 
 final readonly class NginxConfiguration
 {
-    public function __construct(private Config $config)
+    public function __construct(
+        private Config $config,
+        private CorsConfigurationProvider $corsConfiguration,
+    )
     {
     }
 
@@ -24,6 +29,7 @@ final readonly class NginxConfiguration
         $assetDirectory = rtrim($station->getRadioTempDir(), '/')
             . '/' . $this->config->cacheDirectory . '/assets/';
         $transcodeTimeout = $this->config->transcodeTimeout;
+        $corsOriginRules = $this->corsOriginRules($station->id);
 
         $event->appendBlock(<<<NGINX
         # Protected on-demand HLS. Handle this route directly in PHP-FPM so denied
@@ -47,10 +53,20 @@ final readonly class NginxConfiguration
         location ^~ /internal/ondemand-hls/{$stationId}/ {
             internal;
             access_log off;
+            # The allowlist is emitted as exact Origin matches. Nginx omits an
+            # add_header with an empty value, so missing/disallowed Origins do not
+            # receive Access-Control-Allow-Origin. This applies after X-Accel.
+{$corsOriginRules}            add_header Access-Control-Allow-Origin $ondemand_hls_cors_origin always;
+            add_header Vary $ondemand_hls_cors_vary always;
             add_header Cache-Control "private, no-store, max-age=0" always;
             add_header X-Content-Type-Options "nosniff" always;
             alias {$assetDirectory};
         }
         NGINX);
     }
+
+    private function corsOriginRules(int $stationId): string
+    {
+        return NginxRules::forOrigins($this->corsConfiguration->getAllowedOrigins($stationId));
+    }
 }