[jobasfernandes]

Resumo

Corrige dois bugs de CORS que impedem clientes browser cross-origin de usar a API, mesmo com a origem corretamente listada em CORS_ORIGINS. 2 commits, 2 arquivos.

Closes #21.

Bug fixes

• apps/api/src/http/server.ts: o @fastify/cors@11.2.0 passou a usar methods: 'GET,HEAD,POST' por default; sem declarar methods, DELETE/PATCH/PUT eram bloqueados no preflight em todas as rotas (webhooks, sessoes, api-keys via DELETE; tenant/settings e groups via PATCH). Agora o cors declara explicitamente GET/HEAD/POST/PUT/PATCH/DELETE.
• apps/api/src/http/sse.ts: o reply.hijack() do stream descartava os headers de CORS, entao GET /sessions/:id/events saia sem Access-Control-Allow-Origin e qualquer consumidor SSE no browser cross-origin era bloqueado. Agora os headers de CORS computados pelo plugin (access-control-allow-origin, -allow-credentials, vary) sao repassados no writeHead, herdando a politica configurada.

Plano de teste

• pnpm lint, pnpm typecheck e pnpm build terminam zerados.
• curl -X OPTIONS -H "Origin: <origem em CORS_ORIGINS>" -H "Access-Control-Request-Method: DELETE" /webhooks/:id retorna Access-Control-Allow-Methods incluindo DELETE.
• curl -H "Origin: <origem em CORS_ORIGINS>" /sessions/:id/events retorna Access-Control-Allow-Origin.
• Origem fora do CORS_ORIGINS continua bloqueada (sem header ACAO no preflight e no stream).

Summary by CodeRabbit

• Bug Fixes
  • Enhanced cross-origin resource sharing (CORS) configuration to explicitly support all standard HTTP methods (GET, HEAD, POST, PUT, PATCH, DELETE).
  • Improved Server-Sent Events streaming responses to properly maintain and propagate CORS-related headers for better compatibility.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 947a9615-8dd6-498c-8e41-782275c653c9

📥 Commits

Reviewing files that changed from the base of the PR and between c2ccae4 and 006e7b6.

📒 Files selected for processing (2)

• apps/api/src/http/server.ts
• apps/api/src/http/sse.ts

---

📝 Walkthrough

Walkthrough

This PR improves CORS handling across the API server by explicitly declaring allowed HTTP methods in the CORS middleware configuration and propagating computed CORS headers into Server-Sent Events responses. The changes ensure consistent CORS behavior for both regular HTTP endpoints and SSE streams.

Changes

CORS Configuration and SSE Header Propagation

Layer / File(s)	Summary
CORS method allowlist and SSE header propagation apps/api/src/http/server.ts, apps/api/src/http/sse.ts	Fastify CORS middleware registration now explicitly specifies allowed HTTP methods (GET, HEAD, POST, PUT, PATCH, DELETE) via an options object. SSE responses now capture and propagate existing CORS-related headers (access-control-allow-origin, access-control-allow-credentials, vary) from the Fastify reply into the Server-Sent Events stream headers.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related issues

• fix(api): CORS bloqueia DELETE/PATCH e omite header no stream SSE #21: Directly implements the CORS fixes described in the issue—explicit method allowlist in server configuration and CORS header propagation to SSE responses.

Poem

🐰 A rabbit hops through CORS with glee,
Methods declared, headers run free,
SSE streams now wear their crown,
Access-Control keeps flowing down! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main changes: fixing CORS issues for SSE streams and enabling non-safelisted HTTP methods (DELETE/PATCH/PUT).
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}