Function TestServer_CORSPreflightOrigins

lib/httpapi/server_test.go:531–612

(t *testing.T)

}

func TestServer_CORSPreflightOrigins(t *testing.T) {
	cases := []struct {
		name               string
		allowedOrigins     []string
		originHeader       string
		expectedStatusCode int
		expectCORSHeaders  bool
	}{
		{
			name:               "preflight with wildcard origins",
			allowedOrigins:     []string{"*"},
			originHeader:       "https://example.com",
			expectedStatusCode: http.StatusOK,
			expectCORSHeaders:  true,
		},
		{
			name:               "preflight with specific valid origin",
			allowedOrigins:     []string{"https://localhost:3000"},
			originHeader:       "https://localhost:3000",
			expectedStatusCode: http.StatusOK,
			expectCORSHeaders:  true,
		},
		{
			name:               "preflight with invalid origin",
			allowedOrigins:     []string{"https://localhost:3000"},
			originHeader:       "https://malicious.com",
			expectedStatusCode: http.StatusOK, // Request succeeds but no CORS headers
			expectCORSHeaders:  false,
		},
	}

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			t.Parallel()
			ctx := logctx.WithLogger(context.Background(), slog.New(slog.NewTextHandler(os.Stdout, nil)))
			s, err := httpapi.NewServer(ctx, httpapi.ServerConfig{
				AgentType:      msgfmt.AgentTypeClaude,
				AgentIO:        nil,
				Port:           0,
				ChatBasePath:   "/chat",
				AllowedHosts:   []string{"*"}, // Set wildcard to isolate CORS testing
				AllowedOrigins: tc.allowedOrigins,
			})
			require.NoError(t, err)
			tsServer := httptest.NewServer(s.Handler())
			t.Cleanup(tsServer.Close)

			req, err := http.NewRequest("OPTIONS", tsServer.URL+"/status", nil)
			require.NoError(t, err)

			if tc.originHeader != "" {
				req.Header.Set("Origin", tc.originHeader)
			}
			req.Header.Set("Access-Control-Request-Method", "GET")
			req.Header.Set("Access-Control-Request-Headers", "Content-Type")

			client := &http.Client{}
			resp, err := client.Do(req)