[codex] fix plugin manifest size preflight

cloudflare_workers/plugin/index.ts

@@ -3,12 +3,14 @@ import { app as stats } from '../../supabase/functions/_backend/plugins/stats.ts
 import { app as updates } from '../../supabase/functions/_backend/plugins/updates.ts'
 import { app as latency } from '../../supabase/functions/_backend/private/latency.ts'
 import { app as ok } from '../../supabase/functions/_backend/public/ok.ts'
-import { createAllCatch, createHono } from '../../supabase/functions/_backend/utils/hono.ts'
+import { createAllCatch, createHono, useCors } from '../../supabase/functions/_backend/utils/hono.ts'
 import { version } from '../../supabase/functions/_backend/utils/version.ts'
 
 const functionName = 'plugin'
 const app = createHono(functionName, version)
 
+app.use('*', useCors)
+
 // TODO: deprecated remove when everyone use the new endpoint
 app.route('/plugin/ok', ok)
 app.route('/plugin/channel_self', channel_self)

tests/plugin-cors.unit.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest'
+import pluginWorker from '../cloudflare_workers/plugin/index.ts'
+
+describe('cloudflare plugin CORS', () => {
+  it.concurrent('responds to manifest size preflight requests', async () => {
+    const response = await pluginWorker.fetch(new Request('https://api.capgo.app/updates/manifest_size', {
+      method: 'OPTIONS',
+      headers: {
+        'origin': 'https://web.capgo.app',
+        'access-control-request-method': 'POST',
+        'access-control-request-headers': 'content-type,authorization',
+      },
+    }))
+
+    expect(response.status).toBe(204)
+    expect(response.headers.get('access-control-allow-origin')).toBe('*')
+    const allowMethods = response.headers.get('access-control-allow-methods')?.toLowerCase()
+    const allowHeaders = response.headers.get('access-control-allow-headers')?.toLowerCase()
+    expect(allowMethods).toContain('options')
+    expect(allowMethods).toContain('post')
+    expect(allowHeaders).toContain('content-type')
+    expect(allowHeaders).toContain('authorization')
+  })
+})