fix: CORS not being set for assets (#30237)

.changeset/shiny-garlics-carry.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fix CORS headers not being set for assets

apps/meteor/app/cors/server/cors.ts

@@ -79,7 +79,7 @@ WebApp.rawConnectHandlers.use((_req: http.IncomingMessage, res: http.ServerRespo
 const _staticFilesMiddleware = WebAppInternals.staticFilesMiddleware;
 
 // @ts-expect-error - accessing internal property of webapp
-WebAppInternals._staticFilesMiddleware = function (
+WebAppInternals.staticFilesMiddleware = function (
 	staticFiles: StaticFiles,
 	req: http.IncomingMessage,
 	res: http.ServerResponse,

apps/meteor/tests/end-to-end/api/32-assets.ts

@@ -0,0 +1,17 @@
+import { describe, it } from 'mocha';
+
+import { request } from '../../data/api-data.js';
+
+describe('assets', function () {
+	this.retries(0);
+
+	it('should always have CORS headers for assets', async () => {
+		await request.get('/assets/favicon.svg').expect('Content-Type', 'image/svg+xml').expect('Access-Control-Allow-Origin', '*').expect(200);
+
+		await request
+			.get('/fonts/rocketchat.woff2')
+			.expect('Content-Type', 'font/woff2')
+			.expect('Access-Control-Allow-Origin', '*')
+			.expect(200);
+	});
+});