P1B: Refactor (packages/server/src/cors.ts): Function with many returns

[lalamdi]

P1B: Starter Task: Refactoring PR

Use this pull request template to briefly answer the questions below in one to two sentences each.
Feel free to delete this text at the top after filling out the template.

1. Issue

Link to the associated GitHub issue:
#24

Full path to the refactored file:
packages/server/src/cors.ts

What do you think this file does?
(Your answer does not have to be 100% correct; give a reasonable, evidence‑based guess.)

This file determines whether an incoming request origin is allowed. It accepts built-in local and OpenCode origins, configured CORS origins, and requests coming from the same host.

What is the scope of your refactoring within that file?
(Name specific functions/blocks/regions touched.)
I refactored isAllowedCorsOrigin() and added the isBuiltInAllowedOrigin() helper, an array of allowed prefixes, and a set of exact allowed origins.

Which Qlty‑reported issue did you address?
(Name the rule/metric and include the BEFORE value; e.g., “Cognitive Complexity 18 in render()”.)
I addressed “Function with many returns” in isAllowedCorsOrigin() at line 11, which had a before count of 7 returns.

2. Refactoring

How did the specific issue you chose impact the codebase’s maintainability?
The repeated return statements made the different allowed-origin categories harder to scan and update. Adding another built-in origin would also require adding another condition to the function.

What changes did you make to resolve the issue?
I grouped prefix-based origins in an array and exact origins in a set, then moved the built-in validation into isBuiltInAllowedOrigin(). This reduced the number of returns in isAllowedCorsOrigin().

How do your changes improve maintainability? Did you consider alternatives?
The allowed origins are now organized as data and the built-in checks are centralized in one helper. I considered combining everything into one large Boolean expression, but the helper and collections are easier to read and extend.

3. Validation

How did you validate that the change is correct?
I added eight Bun tests covering missing origins, local and application origins, official OpenCode domains, configured origins, rejected origins, same-host requests, different hosts, and invalid URLs. All eight tests passed, the file reached 100% line coverage, typechecking passed, targeted linting reported zero errors, and Qlty no longer reported the selected smell.

Attach a screenshot of the test coverage showing the lines were executed by the tests.

Attach a screenshot showing the test

s that cover the change passing during CI

Attach a screenshot of qlty smells --no-snippets <full/path/to/file.ts> showing fewer reported issues after the changes.