[codex] fix plugin manifest size preflight

[riderx]

Summary (AI generated)

• Added shared CORS handling at the Cloudflare plugin worker boundary.
• Added a regression test for OPTIONS /updates/manifest_size.

Motivation (AI generated)

Browser requests to https://api.capgo.app/updates/manifest_size send a CORS preflight before the POST. The plugin worker did not handle that preflight, so it fell through to the catch-all route and returned 404 Not Found.

Business Impact (AI generated)

This restores manifest-size requests from browser clients, preventing console/API users from seeing failed preflight requests for that endpoint while keeping the existing plugin POST behavior unchanged.

Test Plan (AI generated)

• bun run lint:backend
• bunx eslint cloudflare_workers/plugin/index.ts tests/plugin-cors.unit.test.ts
• bunx vitest run tests/plugin-cors.unit.test.ts tests/manifest-size.unit.test.ts
• Pre-commit typecheck hook: bun run cli:build && vue-tsc --noEmit

Generated with AI

Summary by CodeRabbit

• New Features

  • Apply global CORS handling so all routes return appropriate cross-origin headers.

• Tests

  • Added unit test confirming OPTIONS preflight responses return 204 and include expected CORS headers and allowed methods.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 559e507c-b5ee-43c4-a21b-9773799b76b4

📥 Commits

Reviewing files that changed from the base of the PR and between 6d6ae5d and e228be4.

📒 Files selected for processing (1)

• tests/plugin-cors.unit.test.ts

---

📝 Walkthrough

Walkthrough

The plugin worker now applies CORS middleware globally to all routes by importing and registering useCors. A new test issues an OPTIONS preflight to the manifest_size endpoint and asserts a 204 response with expected CORS headers.

Changes

CORS Middleware Integration

Layer / File(s)	Summary
Worker CORS middleware setup cloudflare_workers/plugin/index.ts	Plugin worker imports useCors and registers it as global middleware for all paths using app.use('*', useCors).
CORS preflight handling test tests/plugin-cors.unit.test.ts	New Vitest suite verifies OPTIONS preflight requests to the manifest_size endpoint return 204 status and include CORS headers: access-control-allow-origin: *, access-control-allow-methods including OPTIONS and POST, and access-control-allow-headers including content-type and authorization.

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: fixing CORS preflight handling for the plugin manifest size endpoint.
Description check	✅ Passed	The description includes summary, motivation, business impact, and a comprehensive test plan, though it lacks some template sections like Screenshots (not applicable) and explicit code style checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing codex/fix-plugin-manifest-cors (e228be4) with main (fb9f85b)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/plugin-cors.unit.test.ts`:
- Around line 17-18: The test in tests/plugin-cors.unit.test.ts currently
asserts only OPTIONS and content-type on the preflight response; update the
assertions around response.headers.get('access-control-allow-methods') and
response.headers.get('access-control-allow-headers') to also verify that 'POST'
is present in the allowed methods and that 'authorization' (use lowercase or
normalize via .toLowerCase()) is present in the allowed headers so the test
fails if the requested POST method or Authorization header are not whitelisted.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 7ea362cd-e663-4115-b5d0-ac43f1a2116b

📥 Commits

Reviewing files that changed from the base of the PR and between f1090d7 and 6d6ae5d.

📒 Files selected for processing (2)

• cloudflare_workers/plugin/index.ts
• tests/plugin-cors.unit.test.ts

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud