From 0b68516defd5d3650f63c18c9666db17c35b38de Mon Sep 17 00:00:00 2001
From: kappa <kappa@inouter.com>
Date: Sat, 7 Feb 2026 19:41:17 +0900
Subject: [PATCH] fix: add Pages preview deployment CORS and init-data header

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 src/routes/api/dashboard.ts | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/routes/api/dashboard.ts b/src/routes/api/dashboard.ts
index 07d8cd9..ee79060 100644
--- a/src/routes/api/dashboard.ts
+++ b/src/routes/api/dashboard.ts
@@ -17,11 +17,16 @@ const logger = createLogger('dashboard-api');
  */
 const dashboardRouter = new Hono<{ Bindings: Env }>();
 
-// CORS for my.anvil.it.com
+// CORS for dashboard domains
 dashboardRouter.use('*', cors({
-  origin: ['https://my.anvil.it.com', 'http://localhost:8788'],
+  origin: [
+    'https://my.anvil.it.com',
+    'https://my-anvil-dashboard.pages.dev',
+    /\.my-anvil-dashboard\.pages\.dev$/,  // Preview deployments
+    'http://localhost:8788',
+  ],
   allowMethods: ['GET', 'POST', 'OPTIONS'],
-  allowHeaders: ['Content-Type', 'Authorization'],
+  allowHeaders: ['Content-Type', 'Authorization', 'X-Telegram-Init-Data'],
   credentials: true,
 }));