fix(api): allow AI review CORS methods

[JSONbored]

Motivation

• The new maintainer UI issues cross-origin PUT and DELETE requests for AI review config and BYOK key removal, but the API CORS preflight only advertised GET, POST, OPTIONS, causing browsers to block those calls.

Description

• Expand the CORS Access-Control-Allow-Methods header to include PUT and DELETE so browser preflights permit the AI review and BYOK routes by advertising GET, POST, PUT, DELETE, OPTIONS in src/api/routes.ts.
• Add integration assertions that preflight responses include the extended methods and specifically cover PUT for /v1/repos/:owner/:repo/ai-review and DELETE for /v1/repos/:owner/:repo/ai-key in test/integration/api.test.ts.
• Modified files: src/api/routes.ts and test/integration/api.test.ts.

Testing

• Ran git diff --check which passed locally.
• Attempted to run npm test -- test/integration/api.test.ts but vitest was not available in the environment so the test run could not be executed.
• Attempted npm install to install test dependencies, but the install failed due to a 403 Forbidden from the npm registry for esbuild, preventing full test execution.

---

Codex Task

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#685 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[ghost]

gittensory · advisory review

Reviewed 2 changed file(s) — two independent AI reviewers.

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR expands the CORS allowed methods to include PUT and DELETE and adds integration tests confirming that preflight requests for AI review and AI key delete endpoints correctly advertise these methods. The change is straightforward and aligns with existing route capabilities.

Suggestions

• Add a brief comment in routes.ts explaining why the CORS methods list was expanded, for future maintainers.
• Ensure that the AI review (PUT) and AI key delete (DELETE) endpoints have proper authentication/authorization checks, as they are now exposed via CORS.

Worth double-checking

• If any route does not actually implement PUT or DELETE, browsers may still think it is allowed, leading to 405 errors after preflight.
• Make sure the expanded CORS methods do not unintentionally expose other mutable endpoints without proper auth.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR updates CORS allowed methods to include PUT and DELETE for AI review and AI key endpoints, and adds corresponding integration tests. The change is narrow, targeted, and well-tested. No public/private boundary or SSRF concerns are evident.

No blocking issues spotted.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[JSONbored]

Closing as a duplicate of #686 — both add PUT/DELETE to the CORS Allow-Methods + the ai-review/ai-key preflight tests. Keeping #686.