fix(cors): add admin.packratai.com + *.workers.dev to root cors allow…#2411
Conversation
…list Root cors runs first and short-circuits OPTIONS preflights before the admin-scoped cors plugin can set Access-Control-Allow-Origin. Admin origin was only in the admin-scoped plugin, so preflights from admin.packratai.com got no origin header. Non-preflight requests worked because the full middleware chain ran and the admin cors added the header to the response. Fix: add admin.packratai.com and *.workers.dev to root cors allowlist so OPTIONS preflights get the origin header reflected back correctly.
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Coverage Report for API Unit Tests Coverage (./packages/api)
File CoverageNo changed files found. |
Coverage Report for Expo Unit Tests Coverage (./apps/expo)
File CoverageNo changed files found. |
There was a problem hiding this comment.
Pull request overview
Updates the API Worker’s root CORS allowlist so OPTIONS preflight requests can be correctly short-circuited with an Access-Control-Allow-Origin response for the admin SPA and Workers dev origins (matching the existing admin-scoped CORS behavior).
Changes:
- Added
packratai.comsubdomain support to the root CORS origin allowlist. - Added
workers.devsupport to the root CORS origin allowlist to cover preflight handling earlier in the middleware chain.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| /^https:\/\/(www\.)?packrat\.world$/, | ||
| /^https:\/\/[\w-]+\.packrat\.world$/, | ||
| /^https:\/\/[\w-]+\.packratai\.com$/, | ||
| /^https?:\/\/[\w-]+\.workers\.dev$/, |
| /^https:\/\/(www\.)?packrat\.world$/, | ||
| /^https:\/\/[\w-]+\.packrat\.world$/, | ||
| /^https:\/\/[\w-]+\.packratai\.com$/, | ||
| /^https?:\/\/[\w-]+\.workers\.dev$/, |
| // Allow the API base URL and any subdomain of packrat.world | ||
| const allowed = [ | ||
| /^https:\/\/(www\.)?packrat\.world$/, | ||
| /^https:\/\/[\w-]+\.packrat\.world$/, | ||
| /^https:\/\/[\w-]+\.packratai\.com$/, |
…list
Root cors runs first and short-circuits OPTIONS preflights before the admin-scoped cors plugin can set Access-Control-Allow-Origin. Admin origin was only in the admin-scoped plugin, so preflights from admin.packratai.com got no origin header. Non-preflight requests worked because the full middleware chain ran and the admin cors added the header to the response.
Fix: add admin.packratai.com and *.workers.dev to root cors allowlist so OPTIONS preflights get the origin header reflected back correctly.
Description
Closes #
Type of change
Area(s) affected
apps/expo)packages/api)apps/landing)apps/guides).github/)Testing
curlor Postman)Screenshots / recordings
Pre-merge checklist
bun format && bun lintpasses with no errorsbun check-typespasses with no errorsfeat:,fix:,chore:, etc.)