DigitalTolk / ex / 25273926771

92%

push

github

fix(cors): allow tauri://localhost origin for desktop app (#55)

* fix(cors): allow tauri://localhost origin for desktop app

The Tauri desktop client uses tauri://localhost as its origin on all
platforms. Changed CORS middleware to accept a list of allowed origins
and echo back the matching one (required when Allow-Credentials is
true). Also added X-Refresh-Token to Allow-Headers for the
keychain-based session restore flow.

In production the allowed list is [cfg.BaseURL, "tauri://localhost"];
in dev mode it stays wildcard "*" as before.

* fix(test): update CORS header assertion for X-Refresh-Token

3171 of 3796 branches covered (83.54%)

Branch coverage included in aggregate %.

16 of 17 new or added lines in 2 files covered. (94.12%)

12430 of 13553 relevant lines covered (91.71%)

1310.05 hits per line