small fix, don't worry about it

backend/internal/middleware/cors.go

@@ -0,0 +1,84 @@
+package middleware
+
+import (
+	"net/http"
+	"strconv"
+	"slices"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/tdvorak/seen/backend/internal/config"
+)
+
+func CORS(cfg config.CORSConfig) gin.HandlerFunc {
+	allowedOrigins := normalizeHeaderValues(cfg.AllowedOrigins)
+	allowedMethods := normalizeHeaderValues(cfg.AllowedMethods)
+	allowedHeaders := normalizeHeaderValues(cfg.AllowedHeaders)
+	exposedHeaders := normalizeHeaderValues(cfg.ExposedHeaders)
+
+	allowAnyOrigin := slices.Contains(allowedOrigins, "*")
+	allowedMethodsValue := strings.Join(allowedMethods, ", ")
+	allowedHeadersValue := strings.Join(allowedHeaders, ", ")
+	exposedHeadersValue := strings.Join(exposedHeaders, ", ")
+
+	return func(c *gin.Context) {
+		origin := strings.TrimSpace(c.GetHeader("Origin"))
+		if origin == "" {
+			c.Next()
+			return
+		}
+
+		if !allowAnyOrigin && !slices.Contains(allowedOrigins, origin) {
+			if c.Request.Method == http.MethodOptions {
+				c.AbortWithStatus(http.StatusForbidden)
+				return
+			}
+
+			c.Next()
+			return
+		}
+
+		if allowAnyOrigin && !cfg.AllowCredentials {
+			c.Header("Access-Control-Allow-Origin", "*")
+		} else {
+			c.Header("Access-Control-Allow-Origin", origin)
+			c.Header("Vary", "Origin")
+		}
+
+		c.Header("Access-Control-Allow-Methods", allowedMethodsValue)
+		c.Header("Access-Control-Allow-Headers", allowedHeadersValue)
+		if exposedHeadersValue != "" {
+			c.Header("Access-Control-Expose-Headers", exposedHeadersValue)
+		}
+		if cfg.AllowCredentials {
+			c.Header("Access-Control-Allow-Credentials", "true")
+		}
+		if cfg.MaxAge > 0 {
+			c.Header("Access-Control-Max-Age", formatSeconds(cfg.MaxAge.Seconds()))
+		}
+
+		if c.Request.Method == http.MethodOptions {
+			c.AbortWithStatus(http.StatusNoContent)
+			return
+		}
+
+		c.Next()
+	}
+}
+
+func normalizeHeaderValues(values []string) []string {
+	items := make([]string, 0, len(values))
+	for _, value := range values {
+		trimmed := strings.TrimSpace(value)
+		if trimmed == "" {
+			continue
+		}
+		items = append(items, trimmed)
+	}
+
+	return items
+}
+
+func formatSeconds(value float64) string {
+	return strconv.Itoa(int(value))
+}

backend/internal/middleware/request_id.go

@@ -0,0 +1,64 @@
+package middleware
+
+import (
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+)
+
+const requestIDHeader = "X-Request-ID"
+
+func RequestID() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		requestID := c.GetHeader(requestIDHeader)
+		if requestID == "" {
+			requestID = uuid.NewString()
+		}
+
+		c.Set("request_id", requestID)
+		c.Header(requestIDHeader, requestID)
+		c.Next()
+	}
+}
+
+func AccessLog(log *zap.Logger) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		start := time.Now()
+		c.Next()
+
+		requestID, _ := c.Get("request_id")
+		log.Info("request",
+			zap.String("method", c.Request.Method),
+			zap.String("path", c.FullPath()),
+			zap.Int("status", c.Writer.Status()),
+			zap.Duration("duration", time.Since(start)),
+			zap.String("client_ip", c.ClientIP()),
+			zap.String("request_id", toString(requestID)),
+		)
+	}
+}
+
+func Recovery(log *zap.Logger) gin.HandlerFunc {
+	return gin.CustomRecovery(func(c *gin.Context, recovered any) {
+		requestID, _ := c.Get("request_id")
+		log.Error("panic recovered",
+			zap.Any("panic", recovered),
+			zap.String("request_id", toString(requestID)),
+		)
+
+		c.AbortWithStatusJSON(500, gin.H{
+			"error":     "internal server error",
+			"requestId": toString(requestID),
+		})
+	})
+}
+
+func toString(value any) string {
+	typed, ok := value.(string)
+	if !ok {
+		return ""
+	}
+	return typed
+}