Improved replication tests and working dashboard to view it working.

src/main.rs

@@ -1,6 +1,9 @@
 use axum::{
     extract::{rejection::JsonRejection, Query, State},
-    http::{header::AUTHORIZATION, HeaderMap, StatusCode},
+    http::{
+        header::{AUTHORIZATION, CONTENT_TYPE},
+        HeaderMap, HeaderValue, Method, StatusCode,
+    },
     routing::get,
     Json, Router,
 };
@@ -749,15 +752,16 @@ async fn sync_once(
             .map_err(|_| SyncError::Fatal("sync status lock poisoned".into()))?;
         (s.last_applied_seq, s.source_instance_id)
     };
-    
+
     let url = format!(
-        "{}/api/replication/changes?after={last}&limit={batch}",
+        "{}/api/replication/changes",
         primary_url.trim_end_matches('/')
     );
 
     let resp = client
         .get(&url)
         .bearer_auth(token)
+        .query(&[("after", last), ("limit", batch)])
         .send()
         .await
         .map_err(|e| SyncError::Transient(format!("request failed: {e}")))?;
@@ -1020,6 +1024,27 @@ async fn main() {
         .layer(tower_http::compression::CompressionLayer::new())
         .with_state(state);
 
+    // Opt-in CORS for a browser dashboard, e.g. APP_CORS_ORIGIN=http://localhost:8080
+    // (use "null" for a page opened from file://). GET only, single origin: a
+    // wildcard with POST would let any website you visit write records or
+    // trigger /api/admin/reload-config on your local instances.
+    let app = match std::env::var("APP_CORS_ORIGIN") {
+        Ok(origin) => {
+            info!(origin = %origin, "CORS enabled");
+            app.layer(
+                tower_http::cors::CorsLayer::new()
+                    .allow_origin(
+                        origin
+                            .parse::<HeaderValue>()
+                            .expect("invalid APP_CORS_ORIGIN"),
+                    )
+                    .allow_methods([Method::GET, Method::POST, Method::OPTIONS])
+                    .allow_headers([CONTENT_TYPE, AUTHORIZATION]),
+            )
+        }
+        Err(_) => app,
+    };
+    
     let addr = std::env::var("APP_BIND").unwrap_or_else(|_| "127.0.0.1:3000".into());
     let listener = tokio::net::TcpListener::bind(&addr)
         .await