fix(cors): allow dashboard origins for public audit reads

[hizrianraz]

Summary

• Add CORSMiddleware to FastAPI app, allowing browser reads from app.ainfera.ai, *.vercel.app previews, marketing site, and local dev.
• 4 unit tests covering allowed origins, Vercel-preview regex, OPTIONS preflight on /v1/audit/public, and unlisted-origin rejection.

Why

The dashboard at app.ainfera.ai calls api.ainfera.ai/v1/audit/public directly from the browser to render the live audit chain, Overview stat cards, and per-agent feeds. The api was returning no Access-Control-Allow-Origin header, so browsers silently dropped the response and every audit-dependent surface rendered empty.

The dashboard-side fixes in web PR (Phase 1 of D7) cleaned up shared layer-mapping bugs that surfaced once we instrumented this, but the actual blocker was always missing CORS.

Test plan

• pytest tests/unit/test_cors.py — 4/4 green
• pytest tests/unit/ — 40/40 green (no regressions)
• ruff check clean
• mypy --strict ainfera_api/main.py clean
• After deploy: curl -sI -H "Origin: https://app.ainfera.ai" https://api.ainfera.ai/v1/audit/public | grep access-control-allow-origin should return the dashboard origin
• After deploy: app.ainfera.ai/audit should render 15 events for hizrianraz

🤖 Generated with Claude Code

---

Note

Medium Risk
Adds global CORS policy (including allow_credentials=True and a permissive header allowlist), so misconfiguration could unintentionally broaden cross-origin access if the origin list/regex is expanded or matched unexpectedly.

Overview
Enables browser-based reads against the API by adding CORSMiddleware to the FastAPI app, allowing requests from the dashboard, marketing domains, localhost dev, and *.vercel.app preview origins (via regex), and supporting preflight OPTIONS.

Adds unit tests to verify allowed origins receive Access-Control-Allow-Origin, preflight works for /v1/audit/public, and unlisted origins do not get CORS headers.

^{Reviewed by Cursor Bugbot for commit 0d300f6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit 0d300f6. Configure here.}

[cursor]

Overly broad Vercel regex allows any origin with credentials

High Severity

The allow_origin_regex pattern r"https://[a-z0-9-]+\.vercel\.app" matches any *.vercel.app subdomain, not just Ainfera's preview deployments. Since Vercel is a free public hosting platform, any attacker can deploy a malicious site there (e.g. https://evil.vercel.app). Combined with allow_credentials=True, the browser will send session cookies to the API and let the attacker's page read the authenticated response — a classic CORS misconfiguration leading to data exfiltration. The regex needs to be scoped to Ainfera's project names only.

 

^{Reviewed by Cursor Bugbot for commit 0d300f6. Configure here.}