fix: make CORS reconciliation recoverable

2026-08-29 23:48:39 +00:00
parent 310ae6a29d
commit 5f4325706b
4 changed files with 131 additions and 23 deletions
@@ -155,7 +155,8 @@ authority is derived from its bucket; a site cannot expose an arbitrary backend.
 `cors_origins` is reconciled as a bucket policy on every split publication. Values are either `*`
 or HTTPS origins; browser access is limited to `GET` and `HEAD`. Omitting the field removes stale
 CORS from that bucket. Protected artifacts cannot allow wildcard CORS. All immutable objects and
-all bucket CORS policies complete before mutable channels change.
+all bucket CORS policies complete before mutable channels change; if any policy write fails, the
+policies already attempted are restored to their pre-publication values.

 Each split route gets a bucket-specific `<bucket>.web.sjc001.fritzlab.net`
 ExternalName Service annotated to disable pass-host-header and a separate Ingress. Route