test(server): cover desktop-origin CORS on environment descriptor GET - #4
Closed
matsvarn wants to merge 1 commit into
Closed
test(server): cover desktop-origin CORS on environment descriptor GET#4matsvarn wants to merge 1 commit into
matsvarn wants to merge 1 commit into
Conversation
Packaged nightly pingdotgg#7102 reported missing ACAO on GET /.well-known/t3/environment while OPTIONS still sent it. Current main already returns ACAO on that GET, including from t3code://app with Accept-Encoding. Lock GET and OPTIONS on the real descriptor route so a middleware regression is red without re-implementing pingdotgg#2594. Co-authored-by: Mats Varnskühler <imMxts@users.noreply.github.com>
github-actions
Bot
added
vouch:trusted
Owner
Author
|
Superseded by the real-repo draft: pingdotgg#7248 (Fixes pingdotgg#7102). Closing this fork-only PR so the issue links to one place. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Changed
Adds two regression tests on the real
makeRoutesLayerdescriptor route:GET /.well-known/t3/environmentfrom the desktop renderer origin (t3code://app) with ChromiumAccept-EncodingOPTIONSpreflight from that originNo production code change. Packaged policy stays wildcard ACAO without credentials.
Fixes pingdotgg#7102
Why
#7102 reported that packaged nightly
0.0.34-nightly.20260815.1101returned 200 JSON for the environment descriptor but omittedAccess-Control-Allow-Originon the GET, while OPTIONS 204 included it. Desktop pairing to remote environments then failed in Chromium. Web same-origin pairing still worked.On current
main,apps/server/dist/bin.mjsalready returns ACAO on that GET (evidence from a packaged localserve+curlwithOrigin: t3code://app). pingdotgg#2594 added CORS at source; pingdotgg#2858 moved the descriptor onto HttpApi and leftHttpRouter.cors()(browserApiCorsLayer) as the GET/OPTIONS interface. That interface works in this pack.The existing server test used a generic origin and no
Accept-Encoding, so it did not lock the desktop Chromium request shape. These tests do. Re-implementing pingdotgg#2594 would duplicate a fix that is already present.Root cause of the nightly report is inference: a stale or different artifact than this
mainpack, or a proxy path not reproduced here. Origin-server GET CORS on this checkout is evidence.UI Changes
No UI changes.
Checklist