Fix CORS handling across API

[Daniele-Cangi]

Summary

Fixes CORS handling across the API so browser clients can correctly use authenticated endpoints.

Changes

• Handle OPTIONS requests before endpoint routing.
• Advertise PUT and DELETE in Access-Control-Allow-Methods.
• Add Access-Control-Allow-Origin consistently to API responses, including errors and 204 responses.

This keeps the existing authentication and API behavior unchanged while making CORS handling consistent across /authorize, /users, and asset endpoints.

[IAmJSD]

@greptile-apps

[greptile-apps]

Greptile Summary

Adds consistent CORS handling throughout the API.

• Handles all OPTIONS requests before endpoint routing.
• Advertises the API’s GET, POST, PUT, and DELETE methods in preflight responses.
• Adds Access-Control-Allow-Origin to successful, error, and empty responses.

Confidence Score: 5/5

The PR appears safe to merge, with consistent CORS coverage across all reachable response paths.

The new wrapper receives mutable locally constructed responses, all response branches include the origin header, and the global preflight method list is valid even though individual resources implement different subsets.

Important Files Changed

Filename	Overview
src/index.ts	Centralizes simple-response CORS decoration, expands preflight methods, and moves preflight handling ahead of route dispatch without introducing an identified defect.

_{Reviews (1): Last reviewed commit: "Fix CORS handling across API" | Re-trigger Greptile}

[IAmJSD]

hmmm interesting, I was concerned about the ordering considering there are new methods and I didn't know if it would cause ww3 if some of the methods on some routes being advertised wrong would be a problem but ig not, merging!

[Daniele-Cangi]

Yeah that was the one part I double-checked too 😄