From 001bba1d2474ee403ab535fe00170e3731ffaacd Mon Sep 17 00:00:00 2001
From: MythEclipse <asepharyanalm001@gmail.com>
Date: Thu, 7 May 2026 21:31:00 +0700
Subject: [PATCH] fix: add CORS headers to relay responses and OPTIONS method
 handling

---
 src/app/api/relay/route.ts | 19 +++++++++++--------
 src/lib/relay-utils.ts     |  6 ++++++
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/src/app/api/relay/route.ts b/src/app/api/relay/route.ts
index a4f50ae..1dae00c 100644
--- a/src/app/api/relay/route.ts
+++ b/src/app/api/relay/route.ts
@@ -9,12 +9,15 @@ import {
 export const runtime = "edge";
 
 async function handler(req: Request): Promise<Response> {
-	const ALLOWED_METHODS = new Set(["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]);
-
-	if (!ALLOWED_METHODS.has(req.method)) {
-		return new Response(JSON.stringify({ error: "Method not allowed" }), {
-			status: 405,
-			headers: { "content-type": "application/json" },
+	if (req.method === "OPTIONS") {
+		return new Response(null, {
+			status: 204,
+			headers: {
+				"Access-Control-Allow-Origin": "*",
+				"Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
+				"Access-Control-Allow-Headers": "*",
+				"Access-Control-Max-Age": "86400",
+			},
 		});
 	}
 
@@ -27,7 +30,7 @@ async function handler(req: Request): Promise<Response> {
 			JSON.stringify({ error: "Missing x-relay-target header" }),
 			{
 				status: 400,
-				headers: { "content-type": "application/json" },
+				headers: { "content-type": "application/json", "Access-Control-Allow-Origin": "*" },
 			},
 		);
 	}
@@ -37,7 +40,7 @@ async function handler(req: Request): Promise<Response> {
 			JSON.stringify({ error: "Target domain not allowed" }),
 			{
 				status: 403,
-				headers: { "content-type": "application/json" },
+				headers: { "content-type": "application/json", "Access-Control-Allow-Origin": "*" },
 			},
 		);
 	}
diff --git a/src/lib/relay-utils.ts b/src/lib/relay-utils.ts
index b7af820..2c18e8a 100644
--- a/src/lib/relay-utils.ts
+++ b/src/lib/relay-utils.ts
@@ -95,6 +95,12 @@ export function createRelayResponse(response: Response): Response {
 	headers.delete("transfer-encoding");
 	headers.delete("connection");
 	headers.delete("keep-alive");
+
+	// Add CORS for browser UI
+	headers.set("Access-Control-Allow-Origin", "*");
+	headers.set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, PATCH, OPTIONS");
+	headers.set("Access-Control-Allow-Headers", "*");
+
 	return new Response(response.body, {
 		status: response.status,
 		headers,