Allow CORS from https://www.xmoj.tech

[Copilot]

The XMOJ main site (https://www.xmoj.tech) was not in the allowed CORS origins list, causing cross-origin requests from it to be rejected.

Changes

• Source/index.ts: Added https://www.xmoj.tech as an exact-match allowed origin in getAllowedOrigin, covering both preflight OPTIONS responses and regular response headers.

const getAllowedOrigin = (origin: string): string | null => {
  // ...existing patterns...
  if (origin === "https://www.xmoj.tech") {
    return origin;
  }
  return null;
};

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• registry.npmmirror.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/_temp/ghcca-node/node/bin/npm install (dns block)
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/_temp/ghcca-node/node/bin/npm install --ignore-scripts (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

---

Summary by cubic

Allow cross-origin requests from https://www.xmoj.tech to our API. This lets the xmoj.tech frontend call our endpoints from the browser.

• New Features
  • Whitelisted https://www.xmoj.tech in CORS via getAllowedOrigin.
  • CORS remains disabled for other origins.

^{Written for commit 8d5c15b. Summary will update on new commits.}

[Copilot]

Pull request overview

This PR updates the Cloudflare Worker entrypoint CORS allowlist to permit browser requests from https://www.xmoj.tech, enabling the xmoj.tech frontend to call the API cross-origin.

Changes:

• Add https://www.xmoj.tech as an explicitly allowed origin in getAllowedOrigin.
• CORS behavior remains deny-by-default for all other origins.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

No issues found across 1 file