"zed serve" flag to specify additional AllowedOrigins

[philrz]

As described in the README for the prototype Zed data source Grafana plugin, such a plugin cannot currently query an out-of-the-box Zed service because the CORS configuration does not permit requests from the http://localhost:3000 origin.

As an interim hack, I was able to get it working in branch by adding the additional entry for http://localhost:3000 here:

https://github.com/brimdata/zed/blob/52c5061b6fbbe9abd1dd754d240104cca647c5aa/service/middleware.go#L33

In a discussion with the team, we agreed that we should introduce a flag to allow this, e.g., zed serve -origin http://localhost:3000. It seems like a flag that the user should be able to invoke multiple times on the same command line so multiple additional origins can be specified, similar to what we do with multiple includes on zed query -I.

[philrz]

Verified in Zed commit 3ca4b8a.

The attached video shows it working as needed with the prototype Grafana plugin described in the opened issue text. That plugin which calls out to the /version endpoint of the Zed service when its Save & Test button is clicked. As discussed in the linked PR #4334, in addition to the new -cors.origin flag now available for zed serve, the default behavior in absence of this flag is to allow all origins. Therefore the attached video shows that a regular zed serve without that flag now accepts connections from the plugin. Once at least one -cors.origin flag is specified, only explicitly specified origins are permitted, which is why the connection fails in the video when I include the -cors.origin for the fake origin http://foo/bar. Then when I add a second origin for the Grafana backend proxy's explicit origin via -cors.origin http://localhost:3000 it works again.

Verify.mp4

Issue brimdata/zui#2639 has been opened track eventually adding a setting in the app's Preferences to invoke this flag on the zed serve launched behind the app. However, since the identified short-term use case with Grafana is now working out-of-the-box, this may not be addressed immediately.

Thanks @nwt!