From 255dc9908f43658e94a4c10121835c3b220723db Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 4 Dec 2025 17:19:28 +0000
Subject: [PATCH] Allow staging preview origins in CORS policy

Add support for *.staging-cambeerfestival.pages.dev domains in the
Cloudflare Worker's CORS configuration. This enables branch-based
staging deployments to access the API.
---
 cloudflare-worker/worker.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/cloudflare-worker/worker.js b/cloudflare-worker/worker.js
index 940c96aa..9a4b0339 100644
--- a/cloudflare-worker/worker.js
+++ b/cloudflare-worker/worker.js
@@ -226,6 +226,16 @@ function getCorsHeaders(request) {
     };
   }
 
+  // Allow Cloudflare Pages staging preview URLs (*.staging-cambeerfestival.pages.dev)
+  // This includes branch-based staging deployments
+  // Security note: Same as above - Cloudflare controls the .pages.dev namespace
+  if (origin.endsWith('.staging-cambeerfestival.pages.dev')) {
+    return {
+      'Access-Control-Allow-Origin': origin,
+      'Access-Control-Allow-Credentials': 'true',
+    };
+  }
+
   // Reject all other origins by not including CORS headers
   return {};
 }