fix(api): allow CORS PUT/DELETE preflights

[JSONbored]

Motivation

• Browser preflight requests for the new maintainer-facing AI routes using PUT and DELETE were blocked because the global CORS response only advertised GET, POST, OPTIONS, preventing dashboard clients from reaching those endpoints.

Description

• Add PUT and DELETE to the Access-Control-Allow-Methods header in src/api/routes.ts so preflights for maintainer AI routes succeed.
• Add integration assertions in test/integration/api.test.ts that the CORS access-control-allow-methods includes PUT/DELETE and that OPTIONS preflights for /v1/repos/:owner/:repo/ai-review and /v1/repos/:owner/:repo/ai-key return 204 from an allowed origin.
• Preserve existing CORS behavior and other headers (credentials, allowed headers, expose headers, max-age, vary).

Testing

• Ran npx vitest run test/integration/api.test.ts and the integration suite passed (all tests passed).
• Ran npx vitest run test/unit/routes-ai-byok.test.ts and the AI BYOK route unit tests passed (all tests passed).

---

Codex Task

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#686 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[ghost]

gittensory · advisory review

Reviewed 2 changed file(s) — two independent AI reviewers.

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR expands the CORS preflight response to include PUT and DELETE methods and adds integration tests to verify the new headers for relevant endpoints. The change is small, straightforward, and does not affect core functionality.

Suggestions

• Add a comment in src/api/routes.ts explaining why the global Allow-Methods header now includes PUT and DELETE.
• Consider updating any API documentation to reflect that PUT/DELETE are now advertised via CORS.
• Ensure that actual route handlers still enforce authentication/authorization for PUT and DELETE requests.

Worth double-checking

• If any route does not properly handle PUT/DELETE, the broader Allow-Methods header could mislead clients.
• Make sure the added methods do not unintentionally expose any insecure endpoints.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR adds PUT and DELETE methods to the CORS preflight Access-Control-Allow-Methods header in src/api/routes.ts, and adds corresponding integration tests in test/integration/api.test.ts to verify the preflight responses for specific endpoints. This is a straightforward, safe change that aligns with the API's actual usage (as evidenced by the test endpoints). No public/private boundary concerns are introduced, as the change only affects CORS headers.

No blocking issues spotted.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	dc40e8a	Commit Preview URL Branch Preview URL	Jun 14 2026, 02:15 PM