rstillwell/deckhearth
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
deckhearth/pages/api
History
Randall Stillwell a84373642e fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5) 
Closes P0 #5 (CORS) from PARTIAL → RESOLVED. fix-auth-bypass
Brief 4 (commit 297afca) cleaned login + register; this brief
sweeps the remaining 24 pages/api/** handlers that carried the
identical scaffolded wildcard-CORS + redundant-OPTIONS pattern,
plus adds a blocking forbidden-cors-headers CI job to lock in
the cleanup against future regression.

Per architect Decision 1 — Option B (sweep all 24 in one PR)
chosen over Option A (narrow verify.js-only + queue separate
sweep). Pattern-drift audit (14 of 24 files spot-checked across
parent + architect) found zero drift; mechanical safety
confirmed.

Per Decision 2 — OPTIONS handler deleted entirely (matches
Brief 4 precedent). Same-origin Vercel deployment doesn't
preflight; method check at top of handler returns 405 if any
client ever sends OPTIONS again.

Per Decision 3 — verify.js's overly-permissive Allow-Methods:
'GET, POST, PUT, DELETE, OPTIONS' is moot (deleted under D2);
the handler's existing `if (req.method !== 'GET') return 405`
guard at line 17 (now line ~5) is the remaining gate.

Per Decision 4 — no new per-route tests this convoy. None of
the 24 routes have vitest coverage today; adding handler-level
tests is the queued fill-vitest-handler-coverage convoy.

Per Decision 5 — new `forbidden-cors-headers` CI job added,
modeled verbatim on `forbidden-endpoints`. Blocking (no
`|| true`, no `continue-on-error`). Greps pages/api/ for any
`Access-Control-Allow-(Origin|Methods|Headers)` reappearance
and exits 1 on hit.

Verification:
  - npm run lint: 128 problems (baseline match)
  - npm run test:run: 21/21 vitest pass (no regression)
  - git grep -nE "Access-Control-Allow-..." -- 'pages/api/**':
    zero matches
  - git grep -nE "OPTIONS" -- 'pages/api/**': zero matches
    (post-sweep)
  - new forbidden-cors-headers grep exits 0 against swept tree

No code paths in lib/**, components/**, scripts/**, or test/**
touched. No package.json / lockfile churn. No workflow YAML
beyond the single ci.yml job addition. No AGENTS.md edits
(doc-writer pass at convoy close).

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-24 20:24:47 -05:00
..
admin fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5) 2026-05-24 20:24:47 -05:00
auth fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5) 2026-05-24 20:24:47 -05:00
cards fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5) 2026-05-24 20:24:47 -05:00
collections fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5) 2026-05-24 20:24:47 -05:00
community fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5) 2026-05-24 20:24:47 -05:00
config ✨ Major Scanner Improvements 2025-07-29 14:19:48 -05:00
decks ✨ Major Scanner Improvements 2025-07-29 14:19:48 -05:00
invite fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5) 2026-05-24 20:24:47 -05:00
public fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5) 2026-05-24 20:24:47 -05:00
user fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5) 2026-05-24 20:24:47 -05:00
users fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5) 2026-05-24 20:24:47 -05:00
auth-utils.js fix(auth): centralize JWT secret + 24h TTL (Brief 1 of fix-auth-bypass) 2026-05-23 10:40:50 -05:00
collections.js fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5) 2026-05-24 20:24:47 -05:00
decks.js ✨ Major Scanner Improvements 2025-07-29 14:19:48 -05:00
favorites.js fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5) 2026-05-24 20:24:47 -05:00
health.js Clean slate: Remove React traces and create pure Next.js setup 2025-07-23 09:32:31 -05:00
user-cards.js ✨ Major Scanner Improvements 2025-07-29 14:19:48 -05:00