fix(api): credentialed CORS for listing claim routes (#2206)

Session-cookie browser clients (claim, promote) were hitting the public
wildcard CORS layer (ACAO: *), which browsers reject with credentials:
include — claims failed as "Failed to fetch". Carve those paths into
authCorsMiddleware, derive the public-cors skip from the mount list so
there is a single source of truth, and add a web-source drift test so
the next session surface cannot ship without the carve-out.

Follow-up for an origin-based single middleware: #2205

Author: zachdunn

tests/api/user-api-keys-cors.test.ts

@@ -1,37 +1,39 @@
 import { describe, it, expect } from "bun:test";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
-import { authCorsMiddleware } from "../../workers/api/src/auth/index.js";
+import {
+  authCorsMiddleware,
+  CREDENTIALED_CORS_MOUNT_PATHS,
+  isCredentialedCorsPath,
+} from "../../workers/api/src/auth/index.js";
 
 // Mirrors the index.ts CORS wiring: authCorsMiddleware owns credentialed CORS on
-// /api/auth/*, /v1/api-keys/*, /v1/me/*, and /v1/workspaces/*; the wildcard public
-// cors() runs on every OTHER path. Without the carve-out the wildcard cors overwrites
-// the credentialed Access-Control-Allow-Origin on the actual response — which a
-// browser rejects for `credentials: "include"` requests (shows as "Failed to fetch").
+// every CREDENTIALED_CORS_MOUNT_PATHS entry; the wildcard public cors() runs on
+// every OTHER path (guarded by isCredentialedCorsPath). Without the carve-out the
+// wildcard cors overwrites the credentialed Access-Control-Allow-Origin on the
+// actual response — which a browser rejects for `credentials: "include"` requests
+// (shows as "Failed to fetch" / CORS blocked).
 function makeApp() {
   const app = new Hono();
-  app.use("/api/auth/*", authCorsMiddleware());
-  app.use("/v1/api-keys", authCorsMiddleware());
-  app.use("/v1/api-keys/*", authCorsMiddleware());
-  app.use("/v1/me/*", authCorsMiddleware());
-  app.use("/v1/workspaces", authCorsMiddleware());
-  app.use("/v1/workspaces/*", authCorsMiddleware());
+  const credentialedCors = authCorsMiddleware();
+  for (const path of CREDENTIALED_CORS_MOUNT_PATHS) {
+    app.use(path, credentialedCors);
+  }
   const publicReadCors = cors();
   app.use("*", (c, next) =>
-    c.req.path.startsWith("/api/auth/") ||
-    c.req.path === "/v1/api-keys" ||
-    c.req.path.startsWith("/v1/api-keys/") ||
-    c.req.path.startsWith("/v1/me/") ||
-    c.req.path === "/v1/workspaces" ||
-    c.req.path.startsWith("/v1/workspaces/")
-      ? next()
-      : publicReadCors(c, next),
+    isCredentialedCorsPath(c.req.path) ? next() : publicReadCors(c, next),
   );
   app.get("/v1/api-keys", (c) => c.json({ apiKeys: [] }));
   app.post("/v1/me/avatar", (c) => c.json({ avatarUrl: "https://media.test/u.png" }));
   app.post("/v1/workspaces/:workspaceId/avatar", (c) =>
     c.json({ avatarUrl: "https://media.test/w.png" }),
   );
+  app.post("/v1/listing/claim", (c) => c.json({ id: "clm_test" }));
+  app.post("/v1/listing/claim/verify", (c) => c.json({ verified: true }));
+  app.get("/v1/listing/claims", (c) => c.json({ claims: [] }));
+  app.post("/v1/listing/promote", (c) => c.json({ promoted: true }));
+  // Anonymous public-write listing routes stay on wildcard CORS.
+  app.post("/v1/listing/validate", (c) => c.json({ ok: true }));
   app.get("/v1/orgs", (c) => c.json({ ok: true }));
   return app;
 }
@@ -104,6 +106,60 @@ describe("session-authed credentialed CORS", () => {
     expect(res.headers.get("access-control-allow-origin")).toBe("*");
   });
 
+  it("keeps wildcard CORS on anonymous listing validate (not session-authed)", async () => {
+    const res = await makeApp().request(
+      "/v1/listing/validate",
+      {
+        method: "POST",
+        headers: { Origin: "https://anything.example" },
+      },
+      { ENVIRONMENT: "production" } as never,
+    );
+    expect(res.headers.get("access-control-allow-origin")).toBe("*");
+    expect(res.headers.get("access-control-allow-credentials")).toBeNull();
+  });
+
+  it("reflects the origin with credentials on listing claim/claims/promote", async () => {
+    const app = makeApp();
+    for (const path of [
+      "/v1/listing/claim",
+      "/v1/listing/claim/verify",
+      "/v1/listing/claims",
+      "/v1/listing/promote",
+    ]) {
+      const res = await app.request(
+        path,
+        {
+          method: path === "/v1/listing/claims" ? "GET" : "POST",
+          headers: { Origin: "https://releases.sh" },
+        },
+        { ENVIRONMENT: "production" } as never,
+      );
+      expect(res.headers.get("access-control-allow-origin")).toBe("https://releases.sh");
+      expect(res.headers.get("access-control-allow-credentials")).toBe("true");
+    }
+  });
+
+  it("allows listing claim preflight with content-type (start claim body)", async () => {
+    const res = await makeApp().request(
+      "/v1/listing/claim",
+      {
+        method: "OPTIONS",
+        headers: {
+          Origin: "https://releases.sh",
+          "Access-Control-Request-Method": "POST",
+          "Access-Control-Request-Headers": "content-type",
+        },
+      },
+      { ENVIRONMENT: "production" } as never,
+    );
+    expect(res.headers.get("access-control-allow-origin")).toBe("https://releases.sh");
+    expect(res.headers.get("access-control-allow-credentials")).toBe("true");
+    expect(res.headers.get("access-control-allow-headers")?.toLowerCase()).toContain(
+      "content-type",
+    );
+  });
+
   it("wildcard CORS on a mistaken double-/v1 path breaks credentialed uploads", async () => {
     const res = await makeApp().request(
       "/v1/v1/workspaces/org_abc/avatar",
@@ -117,3 +173,82 @@ describe("session-authed credentialed CORS", () => {
     expect(res.headers.get("access-control-allow-credentials")).toBeNull();
   });
 });
+
+describe("isCredentialedCorsPath", () => {
+  it("matches every session-authed browser surface", () => {
+    expect(isCredentialedCorsPath("/api/auth/get-session")).toBe(true);
+    expect(isCredentialedCorsPath("/v1/api-keys")).toBe(true);
+    expect(isCredentialedCorsPath("/v1/api-keys/ak_1")).toBe(true);
+    expect(isCredentialedCorsPath("/v1/me/follows")).toBe(true);
+    expect(isCredentialedCorsPath("/v1/workspaces")).toBe(true);
+    expect(isCredentialedCorsPath("/v1/workspaces/ws_1/avatar")).toBe(true);
+    expect(isCredentialedCorsPath("/v1/listing/claim")).toBe(true);
+    expect(isCredentialedCorsPath("/v1/listing/claim/verify")).toBe(true);
+    expect(isCredentialedCorsPath("/v1/listing/claims")).toBe(true);
+    expect(isCredentialedCorsPath("/v1/listing/promote")).toBe(true);
+  });
+
+  it("leaves anonymous public routes on wildcard", () => {
+    expect(isCredentialedCorsPath("/v1/orgs")).toBe(false);
+    expect(isCredentialedCorsPath("/v1/listing/validate")).toBe(false);
+    expect(isCredentialedCorsPath("/v1/listing/activate")).toBe(false);
+  });
+});
+
+/**
+ * Drift gate: browser clients with `credentials: "include"` (or `meGet`) must
+ * hit paths covered by CREDENTIALED_CORS_MOUNT_PATHS. Listing claim shipped
+ * without the carve-out and failed in prod as CORS-blocked "Failed to fetch".
+ *
+ * Scans `web/src` for `apiBase()` / `meGet(...)` path templates. Same-origin
+ * proxies and anonymous listing validate/activate are excluded.
+ */
+describe("browser credentialed clients stay on credentialed CORS", () => {
+  it("every web credentials:include client path is covered by isCredentialedCorsPath", async () => {
+    const { readdir, readFile } = await import("node:fs/promises");
+    const { join } = await import("node:path");
+
+    async function* walk(dir: string): AsyncGenerator<string> {
+      for (const ent of await readdir(dir, { withFileTypes: true })) {
+        const p = join(dir, ent.name);
+        if (ent.isDirectory()) {
+          if (ent.name === "node_modules" || ent.name === "__generated__") continue;
+          yield* walk(p);
+        } else if (/\.(ts|tsx)$/.test(ent.name) && !/\.test\.(ts|tsx)$/.test(ent.name)) {
+          yield p;
+        }
+      }
+    }
+
+    // `${apiBase()}/v1/me/follows` | meGet("/v1/me/settings/…") | …}/v1/listing/claim
+    const PATH_RE = /(?:apiBase\(\)\s*\}?|meGet\(\s*["'`])(\/(?:v1|api)\/[A-Za-z0-9_./${}`-]*)/g;
+    const ANONYMOUS_API_PATHS = new Set(["/v1/listing/validate", "/v1/listing/activate"]);
+
+    const uncovered: string[] = [];
+    const seen = new Set<string>();
+
+    for await (const file of walk(join(import.meta.dir, "../../web/src"))) {
+      const src = await readFile(file, "utf8");
+      // Only session-cookie clients — skip public apiBase() callers (listing validate).
+      if (!/credentials:\s*["']include["']/.test(src) && !/\bmeGet\s*[<(]/.test(src)) continue;
+
+      for (const m of src.matchAll(PATH_RE)) {
+        const path = m[1]!
+          .replace(/\$\{[^}]+\}/g, "_")
+          .replace(/[`'"]/g, "")
+          .split("?")[0]!
+          .replace(/\/$/, "");
+        if (!path || ANONYMOUS_API_PATHS.has(path)) continue;
+        if (seen.has(path)) continue;
+        seen.add(path);
+        if (!isCredentialedCorsPath(path)) {
+          uncovered.push(`${path}  (from ${file.replace(/.*\/web\//, "web/")})`);
+        }
+      }
+    }
+
+    // If this is 0 the regex bit-rotted and the gate is useless.
+    expect(seen.size).toBeGreaterThan(10);
+    expect(uncovered).toEqual([]);
+  });
+});

workers/api/src/auth/index.ts

@@ -677,25 +677,25 @@ function webOriginForEmail(env: { WEB_BASE_URL?: string }): string {
 }
 
 /**
- * Scoped, credentialed CORS for `/api/auth/*` AND the session-authed self-serve
- * surface `/v1/api-keys` (see index.ts). The worker's global `cors()` is
- * wildcard-origin / no-credentials, which cannot carry `Access-Control-Allow-
- * Credentials`; both surfaces need a reflected origin + credentials so the browser
- * will send and store the session cookie. MUST be registered BEFORE the global
- * `cors()` so it owns the preflight (the first matching CORS middleware
- * answers OPTIONS and returns). Allow-list mirrors {@link authTrustedOrigins}: the
- * releases.sh/.localhost family (our first-party web surfaces), every operator-
- * configured `BETTER_AUTH_TRUSTED_ORIGINS` entry — exact origins OR host wildcards
- * (Vercel preview / the portless dev host + its worktree subdomains via a `*.`
- * entry; see {@link matchesTrustedOrigin}) — and bare-loopback origins outside
- * production. Keeping the two in lockstep means CORS never silently blocks an origin
- * Better Auth already trusts.
+ * Scoped, credentialed CORS for `/api/auth/*` AND every session-authed browser
+ * surface (see {@link CREDENTIALED_CORS_MOUNT_PATHS} / index.ts). The worker's
+ * global `cors()` is wildcard-origin / no-credentials, which cannot carry
+ * `Access-Control-Allow-Credentials`; these surfaces need a reflected origin +
+ * credentials so the browser will send and store the session cookie. MUST be
+ * registered BEFORE the global `cors()` so it owns the preflight (the first
+ * matching CORS middleware answers OPTIONS and returns). Allow-list mirrors
+ * {@link authTrustedOrigins}: the releases.sh/.localhost family (our first-party
+ * web surfaces), every operator-configured `BETTER_AUTH_TRUSTED_ORIGINS` entry —
+ * exact origins OR host wildcards (Vercel preview / the portless dev host + its
+ * worktree subdomains via a `*.` entry; see {@link matchesTrustedOrigin}) — and
+ * bare-loopback origins outside production. Keeping the two in lockstep means
+ * CORS never silently blocks an origin Better Auth already trusts.
  *
  * `DELETE` is allowed for the `/v1/api-keys/:id` revoke endpoint; `PUT` for
  * `/v1/me/digest` cadence writes; `PATCH` for `/v1/me/webhooks/:id` updates
  * (pause/resume, filter edits). Better Auth's own `/api/auth/*` routes are
  * POST/GET only, so the extra verbs are no-ops there. The allow-list must cover
- * every method any `/v1/me/*` handler uses or the browser blocks that preflight.
+ * every method any credentialed handler uses or the browser blocks that preflight.
  *
  * The Sentinel client (`sentinelClient`, #1544) stamps every `/api/auth/*` request
  * with custom `X-Visitor-Id` / `X-Request-Id` fingerprint headers (and `X-PoW-Solution`
@@ -715,6 +715,53 @@ export const AUTH_CORS_ALLOWED_HEADERS = [
   "X-PoW-Solution",
 ] as const;
 
+/**
+ * Hono mount patterns for {@link authCorsMiddleware}. **Single source of truth**
+ * for the path carve-out: {@link isCredentialedCorsPath} is derived from this
+ * list, and `index.ts` mounts the same patterns. When adding a session-cookie
+ * browser client (`credentials: "include"`), add a mount here only.
+ *
+ * Anonymous public-write listing routes (`/v1/listing/validate`,
+ * `/v1/listing/activate`) stay on wildcard CORS — do not list them here.
+ */
+export const CREDENTIALED_CORS_MOUNT_PATHS = [
+  "/api/auth/*",
+  "/v1/api-keys",
+  "/v1/api-keys/*",
+  "/v1/me/*",
+  "/v1/workspaces",
+  "/v1/workspaces/*",
+  // Ownership claims + self-serve promote (#1947) — signed-in only.
+  "/v1/listing/claim",
+  "/v1/listing/claim/*",
+  "/v1/listing/claims",
+  "/v1/listing/promote",
+] as const;
+
+/**
+ * Match a request path against a Hono-style mount pattern (`/foo` or `/foo/*`).
+ * `/foo/*` also matches the exact `/foo` base — same as Hono's middleware
+ * matcher (session attach on claim routes relies on this).
+ */
+function matchesCredentialedCorsMount(path: string, pattern: string): boolean {
+  if (pattern.endsWith("/*")) {
+    const base = pattern.slice(0, -2);
+    return path === base || path.startsWith(`${base}/`);
+  }
+  return path === pattern;
+}
+
+/**
+ * True when `path` (no query string) is owned by {@link authCorsMiddleware}.
+ * Derived from {@link CREDENTIALED_CORS_MOUNT_PATHS} so mounts and the public
+ * `cors()` skip stay in lockstep without a second hand-maintained list.
+ */
+export function isCredentialedCorsPath(path: string): boolean {
+  return CREDENTIALED_CORS_MOUNT_PATHS.some((pattern) =>
+    matchesCredentialedCorsMount(path, pattern),
+  );
+}
+
 export function authCorsMiddleware(): MiddlewareHandler<Env> {
   return cors({
     origin: (origin, c) => {

workers/api/src/index.ts

@@ -10,6 +10,8 @@ import type { JWTVerifyGetKey } from "@releases/lib/oauth-jwt";
 import {
   createAuth,
   authCorsMiddleware,
+  CREDENTIALED_CORS_MOUNT_PATHS,
+  isCredentialedCorsPath,
   runAuthWithWaitUntil,
   type BetterAuthInstance,
 } from "./auth/index.js";
@@ -491,37 +493,18 @@ app.onError((err, c) => {
 // the heuristic-caching rationale.
 app.use("*", cacheDefaultDeny());
 
-// Better Auth CORS — credentialed, first-party origins only. MUST come before
-// the global wildcard `cors()` so it owns the `/api/auth/*` preflight (the first
-// matching CORS middleware answers OPTIONS and returns). See src/auth/index.ts.
-app.use("/api/auth/*", authCorsMiddleware());
-// Session-authed self-serve surface needs the same credentialed, origin-reflecting
-// CORS as /api/auth/* so the browser sends the cross-subdomain session cookie.
-app.use("/v1/api-keys", authCorsMiddleware());
-app.use("/v1/api-keys/*", authCorsMiddleware());
-app.use("/v1/me/*", authCorsMiddleware());
-app.use("/v1/workspaces", authCorsMiddleware());
-app.use("/v1/workspaces/*", authCorsMiddleware());
-
-// Public read CORS — wildcard is fine; these endpoints don't accept credentials.
-// SKIP `/api/auth/*`: those routes are owned by `authCorsMiddleware` above, which
-// sets a credentialed, origin-reflecting CORS header. If this wildcard `cors()`
-// also ran there it would overwrite `Access-Control-Allow-Origin` with `*` on the
-// actual (non-preflight) response — which browsers reject for `credentials:
-// "include"` requests. The preflight passes (authCorsMiddleware short-circuits
-// OPTIONS), but the real GET/POST would be blocked. Keep the two in lockstep.
-// SKIP `/v1/api-keys` for the same reason — it is carved out above.
+// Credentialed CORS for first-party session-cookie surfaces, then public
+// wildcard CORS for everything else. MUST register credentialed first so it
+// owns the preflight. Path list is CREDENTIALED_CORS_MOUNT_PATHS (single source
+// of truth; isCredentialedCorsPath is derived from it). If the wildcard also
+// ran on those paths it would clobber ACAO with `*`, which browsers reject for
+// credentials: "include". See auth/index.ts.
+const credentialedCors = authCorsMiddleware();
+for (const path of CREDENTIALED_CORS_MOUNT_PATHS) {
+  app.use(path, credentialedCors);
+}
 const publicReadCors = cors();
-app.use("*", (c, next) =>
-  c.req.path.startsWith("/api/auth/") ||
-  c.req.path === "/v1/api-keys" ||
-  c.req.path.startsWith("/v1/api-keys/") ||
-  c.req.path.startsWith("/v1/me/") ||
-  c.req.path === "/v1/workspaces" ||
-  c.req.path.startsWith("/v1/workspaces/")
-    ? next()
-    : publicReadCors(c, next),
-);
+app.use("*", (c, next) => (isCredentialedCorsPath(c.req.path) ? next() : publicReadCors(c, next)));
 app.use("*", stagingAccessGate());
 app.use("*", blockIndexing());