[johnf]

Summary

CORS was registered on the whole app with any origin allowed. It now covers only /api.

 buildApp
-  cors (every route; HEAD GET POST PUT DELETE OPTIONS)
-  arocapi  { prefix: /api }
-  ldacapi  { prefix: /api }
+  /api scope
+    cors { origin: *, methods: GET HEAD POST, maxAge: 2h }
+    arocapi
+    ldacapi
   oidcProvider        # keeps its own per-client CORS

• Any origin: the API authenticates with bearer tokens, never cookies, so a hostile site can only read what anyone can already fetch. No Access-Control-Allow-Credentials.
• Methods: /api only serves GET, HEAD and POST (search).
• maxAge 2h: every Oni request carries Authorization, so without it each one is preceded by a preflight (Chrome caches preflights for 5s by default and caps them at 2h).
• Routes outside /api (the OIDC provider, and the admin pages when they land) get no CORS headers.

Evidence

• Before: the two new tests in src/app.test.ts fail.
  • OPTIONS /api/search preflight → no max-age, methods include PUT, DELETE
  • OPTIONS /admin/ from another origin → access-control-allow-origin: *
• After: both pass. Full suite 103/103, pnpm lint clean.

Merge Danger

Door: two-way

Blast Radius: small

Browser clients only. A cross-origin client sending PUT or DELETE to /api would now fail its preflight, but no /api route accepts those methods anyway. Changes to the CORS policy can take up to 2h to reach browsers because of the preflight cache.