test(server): cover desktop-origin CORS on environment descriptor GET

[matsvarn]

What Changed

Adds two tests on the real makeRoutesLayer descriptor route:

• GET /.well-known/t3/environment from t3code://app with Chromium Accept-Encoding
• matching OPTIONS preflight from that origin

No production code change. Packaged CORS stays wildcard ACAO without credentials.

Why

#7102 reported that a packaged nightly returned 200 JSON for the environment descriptor without Access-Control-Allow-Origin on the GET, while OPTIONS 204 included it. Desktop pairing to remote environments then failed in Chromium.

On current main the packaged server already returns ACAO on that GET. The existing test used a generic origin and no Accept-Encoding, so it did not lock the desktop Chromium request shape. These tests do. Re-implementing #2594 would duplicate a fix that is already present.

Fixes #7102

Validation

• vp test run apps/server/src/server.test.ts -t "includes CORS headers on desktop-origin"
• vp test run apps/server/src/server.test.ts -t "includes CORS headers on public environment descriptor"
• vp fmt / vp lint on apps/server/src/server.test.ts

UI Changes

None.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes — no UI changes
• I included a video for animation/interaction changes — no animation/interaction changes

---

Note

Low Risk
Test-only changes in server.test.ts with no runtime behavior modifications.

Overview
Adds test-only coverage so desktop Chromium cannot regress on CORS for /.well-known/t3/environment.

Two integration tests hit the real server routes: a GET with origin t3code://app and Accept-Encoding: gzip, deflate, br (matching packaged desktop), asserting 200, JSON body, and browser API CORS response headers; and an OPTIONS preflight from the same origin with access-control-request-method / access-control-request-headers, asserting 204 and preflight CORS headers.

No production or CORS policy changes—the prior public-descriptor CORS test used a generic origin and omitted Accept-Encoding, so it did not pin the desktop request shape reported in #7102.

^{Reviewed by Cursor Bugbot for commit 0db7dff. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add CORS tests for desktop-origin requests to the environment descriptor endpoint

Adds two tests in server.test.ts to verify CORS behavior for requests from t3code://app to /.well-known/t3/environment: one for a GET request (asserts 200, correct body, and CORS response headers) and one for an OPTIONS preflight (asserts 204 and preflight headers).

^{Macroscope summarized 0db7dff.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2e6e354d-79f3-49b0-bd5c-bbf09c2ec638

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[matsvarn]

Closing this. It only added tests for CORS behavior that already works on current main. That does not fix #7102 (packaged nightly GET omitting ACAO) and should not have been opened as a PR.

[macroscopeapp]

Approvability

Verdict: Approved 0db7dff

This PR adds two test cases for desktop-origin CORS behavior on the environment descriptor endpoint. It modifies only test code with no production changes, following existing test patterns in the file.

^{You can customize Macroscope's approvability policy. Learn more.}