feat: warn about unsafe CORS (#12773)

* feat: warn about unsafe CORS

* extend docs

* fix defaults

* bump api version

---------

Co-authored-by: Oliver <oliver.henry.walters@gmail.com>

src/backend/InvenTree/InvenTree/api.py

@@ -267,6 +267,8 @@ class InfoApiSerializer(serializers.Serializer):
     target = serializers.CharField(read_only=True, allow_null=True)
     django_admin = serializers.CharField(read_only=True)
     settings = SettingsSerializer(read_only=True, many=False)
+    """System state details that are mainly for warning purposes and do not require a hard API contract."""
+    system_state = serializers.JSONField(read_only=True)
 
 
 class InfoView(APIView):
@@ -337,6 +339,7 @@ class InfoView(APIView):
                     'LOGIN_ENABLE_PWD_FORGOT'
                 ),
             },
+            'system_state': {'cors_allow_all': settings.CORS_ALLOW_ALL_ORIGINS},
         }
 
         return JsonResponse(data)

src/backend/InvenTree/InvenTree/api_version.py

@@ -1,11 +1,14 @@
 """InvenTree API version information."""
 
 # InvenTree API version
-INVENTREE_API_VERSION = 539
+INVENTREE_API_VERSION = 540
 """Increment this API version number whenever there is a significant change to the API that any clients need to know about."""
 
 INVENTREE_API_TEXT = """
 
+v540 -> 2026-09-04 : https://github.com/inventree/InvenTree/pull/12773
+    - Adds a "system_state" field to the info endpoint for non-critical general system state information
+
 v539 -> 2026-09-02 : https://github.com/inventree/InvenTree/pull/12723
     - Adds search fields to AddressList, ContactList, UserList, GroupList, RuleSetList, and TokenListView API endpoints
 

src/frontend/src/components/nav/Alerts.tsx

@@ -149,6 +149,13 @@ export function getAlerts(
       code: 'INVE-W8',
       message: t`There are pending database migrations.`,
       condition: n_migrations > 0
+    },
+    {
+      key: 'cors',
+      title: t`CORS Settings`,
+      code: 'INVE-W16',
+      message: t`CORS is set to allow all origins.`,
+      condition: server?.system_state?.cors_allow_all || false
     }
   ];
 

src/frontend/src/defaults/defaults.tsx

@@ -21,7 +21,8 @@ export const emptyServerAPI = {
   default_locale: null,
   django_admin: null,
   settings: null,
-  customize: null
+  customize: null,
+  system_state: null
 };
 
 export interface SiteMarkProps {

src/frontend/src/states/states.tsx

@@ -40,6 +40,9 @@ export interface ServerAPIProps {
     navbar_message: string;
     disable_theme_storage: boolean;
   };
+  system_state: {
+    cors_allow_all: null | boolean;
+  } | null;
 }
 
 let pendingGlobalStatesFetch: Promise<void> | null = null;