fix(cm-cors): apply cmCors to teams and project-meta routes#382
Merged
Conversation
Commerce Manager reads/writes the visual builder uiConfig via GET/PUT /api/v1/teams/:teamId (org scope) and GET /api/v1/projects/:projectId/meta (project scope). These routes were registered without the cmCors middleware, so they fell back to wildcard CORS (Access-Control-Allow-Origin: *), which the browser rejects for credentialed requests — CM saw "CORS request did not succeed" and could not load/save the config. Add cmCors to those handlers (+ the /api/v1/teams and /api/v1/teams/* preflights), mirroring the existing projects/workspaces registrations. The project-meta PUT and the workspaces routes already had cmCors. Extend the ep-fork-integrity spec to assert teams + project-meta carry cmCors so this can't regress.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Commerce Manager reads/writes the visual builder
uiConfigviaGET/PUT /api/v1/teams/:teamId(org scope) andGET /api/v1/projects/:projectId/meta(project scope). These routes were registered without thecmCorsmiddleware, so they fell back to wildcard CORS (Access-Control-Allow-Origin: *), which the browser rejects for credentialed requests. Result in-region (e.g. euwest): "CORS request did not succeed" and the CM Visual Builder config page can't load or save.Other CM→Plasmic calls (
projects,workspaces,hosts,auth, …) work because they already carrycmCors;teamswas simply never wired up — CM's config surface is its first-ever caller.Fix
cmCorstoGET/PUT /api/v1/teams/:teamIdand toGET /api/v1/projects/:projectId/meta, plus/api/v1/teamsand/api/v1/teams/*preflights — mirroring the existingprojects/workspacesregistrations (cmCorsfirst, beforeteamApiUserAuth).PUTand allworkspacesroutes already hadcmCors(no change).ep-fork-integrity.spec.tsto assertteams+project-metacarrycmCorsso this can't regress.Test
ep-fork-integrity.spec.ts+cm-cors.spec.tspass (35 tests).