Fix browser SDK CORS on ingest routes

[unjica]

Summary

• Production CORS was a single dashboard allowlist (CORS_ORIGINS) applied to all routes, including /ingest/*
• Browser SDKs send cross-origin POSTs with Authorization from customer domains, so preflight was rejected (404, no Access-Control-Allow-Origin)
• Ingest now reflects any origin without credentials; /api/* keeps the dashboard allowlist with credentials

Root cause

Code bug (not a Railway env misconfiguration). v1.4.3/v1.4.4 did not touch CORS; the restrictive global policy has been in place since cors-config.ts was introduced. Production currently has CORS_ORIGINS=https://telemetry-tracker.com (verified via curl), which is correct for the dashboard but blocks SDK traffic from instrumented apps.

Test plan

• pnpm --filter api test (cors-config + smoke OPTIONS tests)
• pnpm lint && pnpm build
• Bugbot review — no findings
• After deploy: curl -X OPTIONS https://api.telemetry-tracker.com/ingest/event -H "Origin: https://example.com" -H "Access-Control-Request-Method: POST" -H "Access-Control-Request-Headers: authorization,content-type" → 204 with reflected origin

Railway (no env change required for ingest fix)

Ensure API service has:

• CORS_ORIGINS=https://telemetry-tracker.com (or comma-list if using www — see note below)
• TELEMETRY_DASHBOARD_ORIGIN=https://telemetry-tracker.com

Optional: add https://www.telemetry-tracker.com to CORS_ORIGINS if users hit www (www currently 404s on dashboard — separate DNS/hosting issue).

Made with Cursor