The Archive page's GET /calls/search failed its CORS preflight in prod. CORSMiddleware was already mounted but settings.cors_origins defaulted to ["*"] and the live VM .env carries no matching CORS_ORIGINS, so Starlette emitted no Access-Control-* headers.
config.py: default cors_origins -> ["https://drb.cusano.net"] (verified against infra: bare domain only, no app. vhost)
new tests/test_cors.py (4 cases); test_cors_policy.py updated to the no-credentials invariant
.env.example documents CORS_ORIGINS
Sandboxed pytest 305 -> 309, green. VM action: ensure /opt/drb/drb-c2-core/.env has no stale explicit CORS_ORIGINS overriding the new default. Closes#110.
The Archive page's `GET /calls/search` failed its CORS preflight in prod. `CORSMiddleware` was already mounted but `settings.cors_origins` defaulted to `["*"]` and the live VM .env carries no matching `CORS_ORIGINS`, so Starlette emitted no `Access-Control-*` headers.
- `config.py`: default `cors_origins` -> `["https://drb.cusano.net"]` (verified against infra: bare domain only, no `app.` vhost)
- `main.py`: explicit methods + `authorization`/`content-type` headers, `allow_credentials=False` hard-off
- new `tests/test_cors.py` (4 cases); `test_cors_policy.py` updated to the no-credentials invariant
- `.env.example` documents `CORS_ORIGINS`
Sandboxed pytest 305 -> 309, green. **VM action:** ensure `/opt/drb/drb-c2-core/.env` has no stale explicit `CORS_ORIGINS` overriding the new default. Closes #110.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
The Archive page's GET /calls/search failed its CORS preflight (OPTIONS -> 405, no Access-Control-* headers). Allow the app origin(s) explicitly for the standard methods and the authorization/content-type headers.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tbknwttzou4s46PAykmtix
logan
merged commit cea094d66b into main2026-09-07 19:06:25 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The Archive page's
GET /calls/searchfailed its CORS preflight in prod.CORSMiddlewarewas already mounted butsettings.cors_originsdefaulted to["*"]and the live VM .env carries no matchingCORS_ORIGINS, so Starlette emitted noAccess-Control-*headers.config.py: defaultcors_origins->["https://drb.cusano.net"](verified against infra: bare domain only, noapp.vhost)main.py: explicit methods +authorization/content-typeheaders,allow_credentials=Falsehard-offtests/test_cors.py(4 cases);test_cors_policy.pyupdated to the no-credentials invariant.env.exampledocumentsCORS_ORIGINSSandboxed pytest 305 -> 309, green. VM action: ensure
/opt/drb/drb-c2-core/.envhas no stale explicitCORS_ORIGINSoverriding the new default. Closes #110.🤖 Generated with Claude Code