Enable CORS for preflight request

[ezhangy]

Description

This ticket adds the Access-Control-Allow-Origin and Access-Control-Allow-Headers to the Feedback API's preflight requests. This resolves the CORS issue that caused an outage on 2025-08-26 (see outage doc).

Additionally, adds units tests for the rating/comment/email Lambda handlers to check that CORS headers are being included in the response.

Testing strategy

Unit tests

1. npm install
2. npm run test

Steps to test

Test the dev API deployment in the browser by running the front-end feedback widget component locally and redirecting its API requests to the dev API Gateway URL:

1. Clone the feedback-widget repo.
2. Update the API_URL in feedback-widget.js to the dev API Gateway URL.
   • To find the URL in the AWS Console, first make sure you're logged into the Innov-Platform-Dev account! Then search "API Gateway" -> click "Feedback API" in the list of APIs -> click "Stages" in the sidebar -> "Invoke URL" under "Stage details"
3. Open the feedback-widget.html in the browser — you should see a page containing just the frontend feedback widget component. Test that submiting a rating/comment/email works (use the network tab to ensure requests are being sent to the dev API URL and are returning a success response).

Note: Submitting feedback via the widget will write to the production feedback Google Sheet. Please delete them from the sheet after testing if you have access, or ask a Platforms engineer to do so for you.

Additional resources

• "Enabling CORS for a non-simple request" (AWS docs).