Feat: Simple CORS

.github/workflows/spring-codecov.yml

@@ -36,6 +36,7 @@ jobs:
       - name: Setup secrets
         run: |
           echo "${{ secrets.APPLICATION_YML }}" | base64 --decode > src/main/resources/application-secret.yml
+          mkdir -p src/main/resources/db/migration
           echo "${{ secrets.V1_SQL }}" | base64 --decode > src/main/resources/db/migration/V1__Create_festivals_table.sql
           echo "${{ secrets.BAD_WORD_LIST }}" | base64 --decode > src/main/resources/badwords.txt
           echo "${{ secrets.BAD_WORD_LIST }}" | base64 --decode > src/test/resources/badwords.txt

src/main/java/csw/korea/festival/main/config/LimitedThreadFactory.java

@@ -17,7 +17,7 @@ public LimitedThreadFactory(ThreadFactory delegate, int maxConcurrency) {
     @Override
     public Thread newThread(@NotNull Runnable r) {
         Runnable wrappedRunnable = () -> {
-            boolean permitAcquired = false;
+            boolean permitAcquired = false; // TODO: or tryAcquire?
             try {
                 semaphore.acquire();
                 permitAcquired = true;

src/main/java/csw/korea/festival/main/config/security/CorsConfig.java

@@ -0,0 +1,26 @@
+package csw.korea.festival.main.config.security;
+
+import org.jetbrains.annotations.NotNull;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.config.annotation.CorsRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+@Configuration
+public class CorsConfig {
+
+    @Bean
+    public WebMvcConfigurer corsConfigurer() {
+        return new WebMvcConfigurer() {
+            @Override
+            public void addCorsMappings(@NotNull CorsRegistry registry) {
+                registry.addMapping("/graphql")
+                        .allowedOrigins("http://localhost:3001") // Frontend origin
+                        .allowedMethods("GET", "POST", "OPTIONS") // HTTP methods
+                        .allowedHeaders("*") // Allow all headers
+                        .allowCredentials(true) // Allow credentials (cookies, authorization headers, etc.)
+                        .maxAge(3600); // Max age for preflight requests in seconds
+            }
+        };
+    }
+}