From d726e464a6ea5da28d85b71a6b3b35829787422a Mon Sep 17 00:00:00 2001
From: Evan Jarrett <evan@evanjarrett.com>
Date: Tue, 14 Oct 2025 20:56:15 -0500
Subject: [PATCH] add cors middleware

---
 pkg/hold/pds/xrpc.go | 35 ++++++++++++++++++++++++++---------
 1 file changed, 26 insertions(+), 9 deletions(-)

diff --git a/pkg/hold/pds/xrpc.go b/pkg/hold/pds/xrpc.go
index 9904e01..c52fdcc 100644
--- a/pkg/hold/pds/xrpc.go
+++ b/pkg/hold/pds/xrpc.go
@@ -32,26 +32,43 @@ func NewXRPCHandler(pds *HoldPDS, publicURL string, blobStore BlobStore) *XRPCHa
 	}
 }
 
+// corsMiddleware wraps a handler with CORS headers
+func corsMiddleware(next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
+		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
+
+		// Handle preflight OPTIONS requests
+		if r.Method == http.MethodOptions {
+			w.WriteHeader(http.StatusOK)
+			return
+		}
+
+		next(w, r)
+	}
+}
+
 // RegisterHandlers registers all XRPC endpoints
 func (h *XRPCHandler) RegisterHandlers(mux *http.ServeMux) {
 	// Health check endpoint
-	mux.HandleFunc("/xrpc/_health", h.HandleHealth)
+	mux.HandleFunc("/xrpc/_health", corsMiddleware(h.HandleHealth))
 
 	// Standard PDS endpoints
-	mux.HandleFunc("/xrpc/com.atproto.server.describeServer", h.HandleDescribeServer)
-	mux.HandleFunc("/xrpc/com.atproto.repo.describeRepo", h.HandleDescribeRepo)
-	mux.HandleFunc("/xrpc/com.atproto.repo.getRecord", h.HandleGetRecord)
-	mux.HandleFunc("/xrpc/com.atproto.repo.listRecords", h.HandleListRecords)
+	mux.HandleFunc("/xrpc/com.atproto.server.describeServer", corsMiddleware(h.HandleDescribeServer))
+	mux.HandleFunc("/xrpc/com.atproto.repo.describeRepo", corsMiddleware(h.HandleDescribeRepo))
+	mux.HandleFunc("/xrpc/com.atproto.repo.getRecord", corsMiddleware(h.HandleGetRecord))
+	mux.HandleFunc("/xrpc/com.atproto.repo.listRecords", corsMiddleware(h.HandleListRecords))
 
 	// Sync endpoints
-	mux.HandleFunc("/xrpc/com.atproto.sync.listRepos", h.HandleListRepos)
+	mux.HandleFunc("/xrpc/com.atproto.sync.listRepos", corsMiddleware(h.HandleListRepos))
 
 	// Blob endpoints (wrap existing presigned URL logic)
-	mux.HandleFunc("/xrpc/com.atproto.repo.uploadBlob", h.HandleUploadBlob)
-	mux.HandleFunc("/xrpc/com.atproto.sync.getBlob", h.HandleGetBlob)
+	mux.HandleFunc("/xrpc/com.atproto.repo.uploadBlob", corsMiddleware(h.HandleUploadBlob))
+	mux.HandleFunc("/xrpc/com.atproto.sync.getBlob", corsMiddleware(h.HandleGetBlob))
 
 	// DID document
-	mux.HandleFunc("/.well-known/did.json", h.HandleDIDDocument)
+	mux.HandleFunc("/.well-known/did.json", corsMiddleware(h.HandleDIDDocument))
 }
 
 // HandleHealth returns health check information