fix(pds): allow Authorization header in CORS preflight

.changeset/cors-authorization-header.md

@@ -0,0 +1,5 @@
+---
+"@getcirrus/pds": patch
+---
+
+Allow the `Authorization` header in cross-origin requests. Browser clients sending a bearer token were previously blocked at CORS preflight in Firefox and Safari.

packages/pds/src/index.ts

@@ -84,7 +84,7 @@ app.use(
 	cors({
 		origin: "*",
 		allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
-		allowHeaders: ["*"],
+		// Note: No allowHeaders; using "*" wildcard doesn't cover Authorization, so let Hono reflect the requested headers instead
 		exposeHeaders: ["Content-Type"],
 		maxAge: 86400,
 	}),

packages/pds/test/cors.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it } from "vitest";
+import { env, worker } from "./helpers";
+
+describe("CORS preflight", () => {
+	it("reflects the Authorization header back in Access-Control-Allow-Headers", async () => {
+		const response = await worker.fetch(
+			new Request(
+				`http://pds.test/xrpc/com.atproto.server.getSession`,
+				{
+					method: "OPTIONS",
+					headers: {
+						Origin: "https://example.com",
+						"Access-Control-Request-Method": "GET",
+						"Access-Control-Request-Headers": "authorization",
+					},
+				},
+			),
+			env,
+		);
+
+		expect(response.headers.get("Access-Control-Allow-Headers")).toContain(
+			"authorization",
+		);
+	});
+});