deckhearth/.convoys/cors-tighten/brief-1-sweep-wildcard-cors.md

convoy	brief_number	depends_on	files
cors-tighten	1		pages/api/admin/index.js pages/api/auth/verify.js pages/api/cards/[id]/ownership.js pages/api/cards/owned.js pages/api/cards/search.js pages/api/collections.js pages/api/collections/[identifier].js pages/api/collections/[identifier]/activity.js pages/api/collections/[identifier]/cards.js pages/api/collections/[identifier]/permissions.js pages/api/collections/[identifier]/thumbnails.js pages/api/community/collections.js pages/api/favorites.js pages/api/invite/accept.js pages/api/invite/decline.js pages/api/public/collections.js pages/api/user/avatar.js pages/api/user/avatar/generate.js pages/api/user/delete.js pages/api/user/password.js pages/api/user/profile.js pages/api/user/settings.js pages/api/user/stats.js pages/api/users/search.js .github/workflows/ci.yml

Brief 1: Sweep wildcard Access-Control-Allow-Origin from all 24 remaining API handlers + add CI regression-lock

Goal (1 sentence)

Mechanically delete the identical scaffolded 3-line wildcard CORS block (Access-Control-Allow-Origin: '*' + Allow-Methods + Allow-Headers) and the redundant if (req.method === 'OPTIONS') preflight branch from all 24 pages/api/**/*.js files that still carry them, matching the precedent set by fix-auth-bypass Brief 4 (commit 297afca) on login.js + register.js, then add a new blocking forbidden-cors-headers job to .github/workflows/ci.yml (modeled on the existing forbidden-endpoints job) so the cleanup can't accumulate again.

Files in scope (do not edit anything else)

The 24 source files listed in files: above (all modified, no new files, no deletions), plus .github/workflows/ci.yml (modified — add one new job).

Files explicitly out of scope (do not touch even if it seems related):

• pages/api/auth/login.js, pages/api/auth/register.js — already cleaned by fix-auth-bypass Brief 4. Re-verify post-edit that they remain CORS-free, but do NOT modify them.
• pages/api/health.js — never had the wildcard CORS block; not in scope.
• pages/api/cards/import-*.js — listed under no-go zones (external API rate limits, run-against-staging-only). None of them carry the wildcard CORS block today (parent's grep enumerated only the 24 in this brief). Do NOT touch.
• lib/permission-middleware.js, lib/rate-limit.js, lib/auth-secret.js — auth surface is untouched by this convoy.
• .cursor/rules/api-routes.mdc — adding a "no CORS" convention is a doc-writer pass at convoy close, NOT this brief.
• AGENTS.md — same as above; doc-writer owns it.
• test/** — no per-route handler tests are in scope this convoy (Decision D4 in the convoy file). Adding handler-level tests is the queued fill-vitest-handler-coverage convoy.
• tests/smoke/app.smoke.spec.ts, tests/visual/** — smoke + visual suite is same-origin and unaffected; do NOT modify.
• Any .github/workflows/*.yml file other than ci.yml (preview-smoke / visual-diff are owned by adopt-playwright-smoke / fix-vercel-deployment-protection-in-ci).

Conventions to follow

Decisions from the convoy file (cite when implementing)

• Decision D1 (.convoys/cors-tighten.md § Decisions): Option B — sweep all 24 files in one PR. Architect-ratified after a 10-file pattern-drift audit confirmed all 24 share the identical scaffolded shape.
• Decision D2: Delete the OPTIONS preflight handler entirely. Method-check (whether at the top of the handler or branched inside the try block) safely returns 405 for any future OPTIONS request. Matches Brief 4 precedent for login.js + register.js (commit 297afca).
• Decision D3: pages/api/auth/verify.js's over-permissive Allow-Methods: 'GET, POST, PUT, DELETE, OPTIONS' is moot — the entire 3-setHeader block is deleted under D2.
• Decision D4: No new per-route handler tests in this convoy. Smoke + vitest are unchanged and continue to defend against regression at the boundary they already cover.
• Decision D5: Add a new forbidden-cors-headers job to .github/workflows/ci.yml, modeled on the existing forbidden-endpoints job. Fails the build if any Access-Control-Allow-Origin reappears under pages/api/.

Repo conventions (cite + match)

• No-go zones (.cursor/rules/no-go-zones.mdc). None of the 24 source files are listed. .github/workflows/ci.yml is editable per fix-auth-bypass Brief 3 precedent (which added the forbidden-endpoints job).
• API-routes rule (.cursor/rules/api-routes.mdc). The rule does not currently mention CORS. After this convoy ships, the doc-writer pass will add a one-line "no CORS headers on same-origin Vercel deployment" note; do NOT preempt that edit in this brief.
• Brief 4 precedent shape (commit 297afca). That commit deleted, from each of login.js + register.js: the leading // Set CORS headers comment, the three res.setHeader('Access-Control-Allow-*', ...) calls, the leading // Handle preflight requests comment, and the if (req.method === 'OPTIONS') { res.status(200).end(); return; } block. Nothing else changed. Apply the same edit 24 times.
• CI YAML style. Match the existing forbidden-endpoints job verbatim: bash heredoc with a BAD_PATHS array OR a single grep -r-style scan, ::error:: annotation, exit 1 on hit. No continue-on-error. The job is BLOCKING per Decision D5.

Acceptance criteria

Per-file edits (all 24 source files)

Each of the 24 files in files: (excluding ci.yml) MUST end up with:

• Zero Access-Control-Allow-Origin references.
• Zero Access-Control-Allow-Methods references.
• Zero Access-Control-Allow-Headers references.
• Zero if (req.method === 'OPTIONS') blocks.
• Zero // Set CORS headers comments.
• Zero // Handle preflight requests comments.
• The first executable line(s) of export default async function handler(req, res) { are now the existing method check (Pattern A) OR the existing try { ... } catch block (Pattern B). Nothing else is reordered.

Two distinct pre-edit shapes exist among the 24 (both safe to sweep mechanically — see § Boot-the-brief findings, Finding 2):

Pattern A — top-level method gate after the CORS block. Example: pages/api/auth/verify.js.

Before:

export default async function handler(req, res) {
  // Set CORS headers
  res.setHeader('Access-Control-Allow-Origin', '*');
  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');

  // Handle preflight requests
  if (req.method === 'OPTIONS') {
    res.status(200).end();
    return;
  }

  if (req.method !== 'GET') {
    return res.status(405).json({ error: 'Method not allowed' });
  }

  try {
    // ... handler body ...

After:

export default async function handler(req, res) {
  if (req.method !== 'GET') {
    return res.status(405).json({ error: 'Method not allowed' });
  }

  try {
    // ... handler body ...

Pattern B — method-branched inside the try block (no top-level method gate). Example: pages/api/collections/[identifier].js, pages/api/collections/[identifier]/permissions.js, pages/api/collections.js.

Before:

export default async function handler(req, res) {
  // Set CORS headers
  res.setHeader('Access-Control-Allow-Origin', '*');
  res.setHeader('Access-Control-Allow-Methods', 'GET, PUT, DELETE, OPTIONS');
  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');

  // Handle preflight requests
  if (req.method === 'OPTIONS') {
    res.status(200).end();
    return;
  }

  try {
    // ... handler that routes on req.method internally ...

After:

export default async function handler(req, res) {
  try {
    // ... handler that routes on req.method internally ...

In both shapes, the edit is purely a deletion. No new lines are added. No re-indentation. Preserve the blank line that already sits between the deleted block and what follows (matches Brief 4's commit style).

.github/workflows/ci.yml (modified — new job)

• Add a new job named forbidden-cors-headers to the jobs: block, sequenced AFTER the existing forbidden-endpoints job and BEFORE test. Verbatim shape:

  forbidden-cors-headers:
    name: No wildcard CORS in pages/api
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Fail if any pages/api/ handler carries Access-Control-Allow-Origin
        run: |
          # The tcg-vault frontend and API are served from the same Vercel
          # deployment (same origin), so CORS headers serve no purpose and
          # are a documented attack surface (see .convoys/cors-tighten.md
          # and AGENTS.md Gotcha #5). Brief 4 of fix-auth-bypass cleaned
          # login.js + register.js; the cors-tighten convoy swept the
          # remaining 24 files. This job locks the cleanup in.
          #
          # If a future cross-origin caller is legitimately needed, design
          # a proper CORS layer (probably via middleware) rather than
          # scaffolding wildcards into individual handlers.
          MATCHES=$(grep -rEn 'Access-Control-Allow-(Origin|Methods|Headers)' pages/api/ 2>/dev/null || true)
          if [ -n "$MATCHES" ]; then
            echo "::error::Forbidden CORS headers present under pages/api/. Remove them — same-origin Vercel deployment does not need CORS."
            echo "$MATCHES" | while IFS= read -r line; do
              file=$(echo "$line" | cut -d: -f1)
              lineno=$(echo "$line" | cut -d: -f2)
              echo "::error file=${file},line=${lineno}::Forbidden CORS header — delete this line."
            done
            exit 1
          fi
          echo "OK: no Access-Control-Allow-* headers under pages/api/."          

Notes:

• The job is BLOCKING (no continue-on-error, no || true wrapper, matches the existing forbidden-endpoints shape per Decision D5).

• The grep pattern matches all three forbidden header families in one pass — Origin, Methods, Headers. A real cross-origin layer (some future convoy) would NOT set these in handlers; it would set them in middleware. So this regression-lock won't be in the way of a legitimate future CORS design.

• The job sits between forbidden-endpoints and test in the YAML; insertion-order matches the logical grouping (both forbidden-* checks are static-source guards before the runtime test job).

• No new dependencies, no new caching, no actions/setup-node — the grep is plain bash on the runner.

• No other change to ci.yml. The existing lint, schema-map-fresh, forbidden-endpoints, and test jobs all stay byte-identical. The env: block, on:, concurrency:, and NODE_VERSION stay untouched.

Cross-file checks

• Repo-wide grep clean. After the sweep:

  rg 'Access-Control-Allow-Origin' pages/api/
  

  Expected: zero matches. (rg exits 1 on no-match by default; that's the success state. If you prefer grep, grep -r 'Access-Control-Allow-Origin' pages/api/ || echo "OK" is equivalent.)

  Same check for Access-Control-Allow-Methods and Access-Control-Allow-Headers — both should return zero matches.

• Repo-wide grep for OPTIONS preflight clean.

  rg "if \(req\.method === 'OPTIONS'\)" pages/api/
  

  Expected: zero matches. (Same rg-on-no-match exit-1 semantics.)

• npm run lint exit code unchanged. The current baseline is ✖ 128 problems (81 errors, 47 warnings) (per bump-next-js § Decision D and fix-lint-baseline tracking). The sweep is pure deletion of method calls + control-flow blocks; it should NOT introduce any new lint findings, and most likely will reduce the count slightly (each deleted unused req access could clear a no-unused-expressions warning). If the count grows, investigate before commit.

• npm run test:run (vitest) passes 21/21. The sweep does not touch any module that has a vitest spec (lib/auth-secret.js, lib/permission-middleware.js, pages/api/auth-utils.js, components/Layout.js). Test count and pass/fail status MUST be unchanged.

• npm run build exit 0. Turbopack compile time should be unchanged (~1-2s per bump-next-js). The 24 modified handlers still export the same default async function handler signature; their compiled output is purely smaller.

• Smoke spec still passes locally and in CI. tests/smoke/app.smoke.spec.ts hits / (homepage), /login, and /api/health — none of which are in the 24 swept files. The smoke spec is also same-origin (it talks to the Vercel preview URL directly via Playwright's extraHTTPHeaders bypass), so even if it hit a swept handler, the CORS removal would be irrelevant. Run npm run test:smoke locally against next dev to verify.

• CI forbidden-cors-headers job actually fires the regression-lock. As a one-shot local sanity check before commit (do NOT commit the temporary line):

  echo "res.setHeader('Access-Control-Allow-Origin', '*');" >> pages/api/health.js
  grep -rEn 'Access-Control-Allow-(Origin|Methods|Headers)' pages/api/ && echo "FAIL EXPECTED — job would block"
  git checkout pages/api/health.js
  

  Expected: the grep matches the injected line, confirming the new job would block. Then revert.

• Diff hygiene. git diff main..HEAD --stat should show:

  • 24 pages/api/*.js files with only deletions (each ~9-11 lines removed, no additions per file).
  • 1 .github/workflows/ci.yml with only additions (~20-25 lines for the new job block).
  • No whitespace-only changes elsewhere.

pages/api/auth/verify.js post-edit verbatim shape

Because verify.js was the originally-documented narrow target of this convoy (and the architect's primary spot-check file), the post-edit shape is locked here as the canonical reference for the other 23 files:

import { sql } from '@vercel/postgres';
import jwt from 'jsonwebtoken';
import { JWT_SECRET } from '../../../lib/auth-secret.js';

export default async function handler(req, res) {
  if (req.method !== 'GET') {
    return res.status(405).json({ error: 'Method not allowed' });
  }

  try {
    const authHeader = req.headers.authorization;
    
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      return res.status(401).json({ error: 'Authentication required' });
    }

    const token = authHeader.substring(7);
    
    try {
      const decoded = jwt.verify(token, JWT_SECRET);
      
      // Get user data from database
      const result = await sql`
        SELECT id, email, role, created_at 
        FROM users 
        WHERE id = ${decoded.userId}
      `;

      if (result.rows.length === 0) {
        return res.status(401).json({ error: 'User not found' });
      }

      const user = result.rows[0];
      res.status(200).json(user);

    } catch (jwtError) {
      console.error('JWT verification error:', jwtError);
      return res.status(401).json({ error: 'Invalid token' });
    }

  } catch (error) {
    console.error('Auth verification error:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
}

Net: 10 lines deleted (3 setHeader calls + 4-line OPTIONS-if block + 2 leading // comments + 1 blank line). No additions.

Manual verification (in addition to CI on push)

Run these in order. Paste relevant output (with secrets redacted) into the PR description.

• Pre-sweep baseline. Capture the current grep state:

  rg -c 'Access-Control-Allow-Origin' pages/api/ | sort
  

  Expected output: 24 lines, each with :1 (one Access-Control-Allow-Origin reference per file). If any file shows :2 or higher, an unanticipated drift exists — STOP, investigate, and flag back to the architect before sweeping.

• Apply the sweep. Edit each of the 24 files per the Pattern A / Pattern B shapes above. A sed-style mechanical edit is acceptable but verify each file post-edit with a git diff <file> review — the diff for each should be 9-11 lines deletion only, no additions.

• Post-sweep grep verification.

  rg 'Access-Control-Allow-Origin|Access-Control-Allow-Methods|Access-Control-Allow-Headers' pages/api/
  

  Expected: zero matches (exit 1 on no-match for rg). Same for the OPTIONS-if pattern:

  rg "req\.method === 'OPTIONS'" pages/api/
  

• Per-file pre/post line-count parity for the 24 files. For each file:

  for f in $(rg -l 'export default async function handler' pages/api/); do
    echo "$f: $(wc -l < "$f") lines"
  done
  

  Compare to a git show main:<path> snapshot. Each of the 24 should drop by 9-11 lines; the other 3 (login.js, register.js, health.js) stay unchanged.

• Local build smoke.

  npm run build
  

  Expected: Turbopack compile success, 23 static pages + 47 API routes per the post-bump-next-js baseline. Any "Module not found" or "Unexpected token" failure means the sweep landed mid-statement on some file — review that file's diff manually.

• Local dev-server functional check (representative sample). Boot npm run dev, then hit a few of the swept routes via curl to confirm they still 200 / 401 / 405 correctly:

  curl -sS -o /dev/null -w "%{http_code}\n" http://localhost:3000/api/auth/verify        # expect 401 (no Bearer)
  curl -sS -o /dev/null -w "%{http_code}\n" -X GET http://localhost:3000/api/cards/search # expect 401 (no Bearer) or 200 if anon allowed
  curl -sS -o /dev/null -w "%{http_code}\n" -X OPTIONS http://localhost:3000/api/auth/verify  # expect 405 (Pattern A) — was 200 pre-sweep
  curl -sS -o /dev/null -w "%{http_code}\n" -X OPTIONS http://localhost:3000/api/collections  # expect 405 (Pattern B fall-through) — was 200 pre-sweep
  curl -sS -o /dev/null -w "%{http_code}\n" http://localhost:3000/api/public/collections   # expect 200 (anonymous, GET)
  curl -sSI http://localhost:3000/api/public/collections | grep -i 'access-control' || echo "OK: no CORS headers in response"
  

  The last check is the key assertion: the response from public/collections.js (the most "intentionally public" of the 24) MUST not carry any Access-Control-Allow-* header.

• Smoke spec passes locally.

  npm run dev  # in one terminal
  BASE_URL=http://localhost:3000 npm run test:smoke  # in another
  

  Expected: 3/3 tests pass. If any fails, the sweep accidentally hit a smoke-touched path — investigate (unlikely since smoke targets /, /login, /api/health, none of which are in scope).

• CI forbidden-cors-headers job fires on push. After committing and pushing:

  • The new job appears in the PR's CI checks list.
  • It exits 0 (no matches) on this branch.
  • As a sanity probe (don't actually push this), if you push a one-line revert of pages/api/auth/verify.js's CORS block, the job MUST exit 1 with the documented ::error:: annotation and an explicit file= + line= pointer.

• Vitest pass count unchanged.

  npm run test:run 2>&1 | tail -5
  

  Expected: Tests 21 passed (21). If the count or any individual test changes, the sweep was not the pure deletion it should have been.

Boot-the-brief findings (preempted by the architect; do not re-investigate)

Finding 1 — Both shapes (Pattern A and Pattern B) are safe to sweep mechanically

The architect read 10 of 24 files (parent spot-checked 3 + architect spot-checked 7 additional). All 10 share the IDENTICAL 3-line CORS block + IDENTICAL OPTIONS-if block. The only structural variation across the 24 is whether the file has a top-level method gate IMMEDIATELY after the OPTIONS block (Pattern A — verify.js, admin/index.js, user/avatar/generate.js, cards/[id]/ownership.js, invite/accept.js, public/collections.js, cards/owned.js, community/collections.js, cards/search.js, invite/decline.js, and likely several more) OR routes by method inside the try block (Pattern B — collections.js, collections/[identifier].js, collections/[identifier]/permissions.js, user/avatar.js, and likely several more). In both shapes, the edit is purely a deletion of the same 9-11 lines (the comment + 3 setHeader calls + the OPTIONS-if). No re-indentation, no re-flow, no behavior change to the post-block code. Post-sweep, an OPTIONS request returns 405 (Pattern A) or falls through to the else { 405 } branch inside the try block (Pattern B) — both strictly safer than the pre-sweep 200-to-everyone.

Finding 2 — No file uses withCollectionPermission(...)

The convoy file's stress-test concern about CORS headers being inside vs outside a withCollectionPermission wrapper turned out to be moot: rg withCollectionPermission pages/api/ returns zero files. The wrapper is documented in .cursor/rules/api-routes.mdc but no current route actually uses it (collection-scoped routes like collections/[identifier]/permissions.js instead call getUserFromRequest directly inside the handler body). So there's no wrap-shape preservation concern.

Finding 3 — No file uses checkAuthRateLimit(...)

Only login.js and register.js import lib/rate-limit.js (post-Brief-4). None of the 24 swept files do. So there's no rate-limit-gate ordering concern. (If a future convoy adds rate limiting to any of the 24, that convoy will sequence the gate the same way Brief 4 did: method check → rate-limit gate → body parsing.)

Finding 4 — pages/api/public/collections.js is NOT a special case

It is GET-only, returns featured public-collections metadata anonymously, and has no documented external consumer. The same-origin Vercel deployment means the existing frontend reaches it without needing the wildcard. If a third-party app ever needs to call this endpoint cross-origin, design a proper CORS layer at that point (probably via Next.js middleware). YAGNI now; sweep it like any other file.

Finding 5 — pages/api/auth/verify.js's Allow-Methods list was over-permissive but it's moot post-sweep

The pre-sweep header read 'GET, POST, PUT, DELETE, OPTIONS' even though the route's actual gate is if (req.method !== 'GET') return 405. Decision D3 in the convoy file calls this out as a no-op because the entire Allow-Methods line is being deleted. Do NOT tighten the verb list — just delete the line.

Finding 6 — Pre-sweep OPTIONS responses currently return 200 with no body

A quick same-origin curl confirms the pre-sweep behavior:

$ curl -sS -o /dev/null -w "%{http_code}\n" -X OPTIONS http://localhost:3000/api/auth/verify
200

Post-sweep behavior (per the new code path):

• Pattern A files: 405 from the top-level method gate.
• Pattern B files: 405 from the in-try else branch (after the try block does its getUserFromRequest + identifier parsing). The body work is wasted but the response is correct.

This is a deliberate behavior change — the convoy spec's success metric explicitly states: "Browser-issued cross-origin POSTs to the auth surface return a CORS error instead of succeeding." A 405 on OPTIONS (or no response at all if the browser's same-origin policy intervenes first) is the desired end state.

Finding 7 — .github/workflows/ci.yml's existing forbidden-endpoints job is the right precedent shape

The new forbidden-cors-headers job uses the same idioms: actions/checkout@v4, plain bash, ::error:: annotation with file= + line= pointers, exit 1 on hit. No npm ci, no setup-node, no caching — the grep is a static-source check on the checked-out tree. The job sits between forbidden-endpoints and test in the YAML for logical grouping (both forbidden-* checks are static-source guards before the runtime test job).

Finding 8 — .cursor/rules/no-go-zones.mdc audit passed

None of the 24 source files are listed under no-go zones. .github/workflows/ci.yml is editable per the fix-auth-bypass Brief 3 precedent (which added the forbidden-endpoints job). No scripts/add-*.js / scripts/fix-*.js / scripts/seed-*.js files are touched. Safe to sweep.

Finding 9 — Smoke + vitest defense remains intact

The smoke spec (tests/smoke/app.smoke.spec.ts) covers /, /login, /api/health — none in scope. Vitest covers lib/auth-secret.js, lib/permission-middleware.js, pages/api/auth-utils.js, components/Layout.js — none in scope. So the sweep ships with no per-route regression coverage for the 24 routes themselves, which the convoy file acknowledges and defers to the queued fill-vitest-handler-coverage convoy. The architect's recommendation NOT to add new tests in this convoy (Decision D4) is the right call: handler-level test scaffolding is its own scope.

Out of scope (do not do these)

• Do NOT introduce a new lib/cors.js helper, a middleware layer, or any abstraction. The right answer here is "no CORS at all", same as Brief 4 settled on for login.js + register.js.
• Do NOT replace the wildcard with a specific origin (https://tcgvault.com or the preview URL). The branding is unresolved (queued pick-a-name convoy) and the same-origin deployment makes the header unnecessary anyway. YAGNI.
• Do NOT add a next.config.js headers() block to enforce CORS globally — that's the inverse of this convoy's intent (no CORS, anywhere).
• Do NOT modify pages/api/auth/login.js or pages/api/auth/register.js — already cleaned by Brief 4.
• Do NOT modify pages/api/health.js — never had the wildcard; not in scope.
• Do NOT modify any pages/api/cards/import-*.js file — listed under no-go zones (AGENTS.md Common Gotcha #3) and didn't carry the wildcard anyway.
• Do NOT tighten Allow-Methods verb lists pre-deletion (e.g., 'GET, POST, PUT, DELETE, OPTIONS' → 'GET, OPTIONS' on verify.js). The whole line is deleted; tightening it first is wasted edit churn (Decision D3).
• Do NOT add per-route handler tests in this convoy (Decision D4). Queued as fill-vitest-handler-coverage.
• Do NOT touch .cursor/rules/api-routes.mdc or AGENTS.md — doc-writer pass at convoy close owns those (a one-line "no CORS headers on same-origin Vercel deployment" note will be added there, not here).
• Do NOT touch preview-smoke.yml or visual-diff.yml — owned by adopt-playwright-smoke and fix-vercel-deployment-protection-in-ci.
• Do NOT add a continue-on-error: true to the new forbidden-cors-headers job — it is BLOCKING per Decision D5 (mirrors forbidden-endpoints).
• Do NOT broaden the grep in the new CI job to scan outside pages/api/. The convoy's scope is the API surface. If lib/ or components/ ever grows a CORS reference, that's a separate concern and a separate convoy.
• Do NOT run npm audit fix as part of this brief. The sweep does not change package.json or package-lock.json.

Rationale (≤3 sentences)

The 24 wildcard CORS blocks across pages/api/** are scaffolding cruft from the original route templates; the same-origin Vercel deployment makes them serve no legitimate purpose, and the wildcard plus credential-stuffing rate-limit gap is the documented P0 #5 remainder from fix-auth-bypass Brief 4. A single mechanical sweep matches Brief 4's precedent shape exactly (same delete-the-3-setHeaders + delete-the-OPTIONS-if pattern, applied 24 times instead of 2) and is reviewable as one PR because every file's diff is structurally identical. Adding the forbidden-cors-headers CI job in the same PR locks the cleanup in — 24 files is enough surface that a future scaffold-style PR could easily re-introduce the pattern without the gate.