From 0db7dff83b13356935a372a76697384ea7e580d1 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 16 Aug 2026 18:31:51 +0000
Subject: [PATCH] test(server): cover desktop-origin CORS on environment
 descriptor GET
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Packaged nightly #7102 reported missing ACAO on GET /.well-known/t3/environment
while OPTIONS still sent it. Current main already returns ACAO on that GET,
including from t3code://app with Accept-Encoding. Lock GET and OPTIONS on the
real descriptor route so a middleware regression is red without re-implementing #2594.

Co-authored-by: Mats Varnskühler <imMxts@users.noreply.github.com>
---
 apps/server/src/server.test.ts | 40 ++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/apps/server/src/server.test.ts b/apps/server/src/server.test.ts
index 89f903c4f895..d6242db995a7 100644
--- a/apps/server/src/server.test.ts
+++ b/apps/server/src/server.test.ts
@@ -1530,6 +1530,46 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
     }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
 
+  it.effect(
+    "includes CORS headers on desktop-origin environment descriptor GET with Accept-Encoding",
+    () =>
+      Effect.gen(function* () {
+        yield* buildAppUnderTest();
+
+        const url = yield* getHttpServerUrl("/.well-known/t3/environment");
+        const response = yield* fetchEffect(url, {
+          headers: {
+            origin: "t3code://app",
+            "accept-encoding": "gzip, deflate, br",
+          },
+        });
+        const body = yield* responseJsonEffect<typeof testEnvironmentDescriptor>(response);
+
+        assert.equal(response.status, 200);
+        assertBrowserApiCorsResponseHeaders(response.headers);
+        assert.deepEqual(body, testEnvironmentDescriptor);
+      }).pipe(Effect.provide(NodeHttpServer.layerTest)),
+  );
+
+  it.effect("includes CORS headers on desktop-origin environment descriptor OPTIONS", () =>
+    Effect.gen(function* () {
+      yield* buildAppUnderTest();
+
+      const url = yield* getHttpServerUrl("/.well-known/t3/environment");
+      const response = yield* fetchEffect(url, {
+        method: "OPTIONS",
+        headers: {
+          origin: "t3code://app",
+          "access-control-request-method": "GET",
+          "access-control-request-headers": "content-type",
+        },
+      });
+
+      assert.equal(response.status, 204);
+      assertBrowserApiCorsPreflightHeaders(response.headers);
+    }).pipe(Effect.provide(NodeHttpServer.layerTest)),
+  );
+
   it.effect("reports unauthenticated session state without requiring auth", () =>
     Effect.gen(function* () {
       yield* buildAppUnderTest();