fix(cors): allow every supported API method - #744
Conversation
|
Warning Review limit reached
Next review available in: 32 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Comment |
|
@opencode-agent @cwl-noema-review @coderabbitai Please review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_sha='c319bed12b081f99e03324cf95925b1e139b2f14'
repo='ContextualWisdomLab/pg-erd-cloud'
pr='744'
echo '== Local checkout and commit scope =='
git rev-parse HEAD
git show --no-ext-diff --format='commit=%H%nparents=%P%nsubject=%s' --stat "$expected_sha"
git diff-tree --no-commit-id --name-status -r "$expected_sha"
git diff --no-ext-diff "${expected_sha}^" "$expected_sha"
echo '== Changed-file outlines =='
while IFS= read -r path; do
[ -n "$path" ] || continue
echo "--- $path ---"
ast-grep outline "$path" --items all || true
done < <(git diff-tree --no-commit-id --name-only -r "$expected_sha")
echo '== Pull request and commit metadata =='
gh pr view "$pr" --repo "$repo" --json number,headRefOid,baseRefOid,changedFiles,files,commits,reviewDecision,mergeStateStatus,statusCheckRollup
gh api "repos/$repo/commits/$expected_sha/check-runs?per_page=100" \
--jq '.check_runs[] | {name, head_sha, status, conclusion, details_url}'
gh api "repos/$repo/commits/$expected_sha/status" \
--jq '{sha, state, statuses: [.statuses[] | {context, state, target_url}]}'
echo '== Pull request reviews and unresolved review threads =='
gh api "repos/$repo/pulls/$pr/reviews?per_page=100" \
--jq '.[] | {user: .user.login, state, commit_id, submitted_at, body}'
gh api graphql -F owner='ContextualWisdomLab' -F name='pg-erd-cloud' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
originalLine
comments(first: 20) {
nodes { author { login } body url createdAt }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] |
select(.isResolved == false) |
{isOutdated, path, line, originalLine, comments}'Length of output: 3150 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_sha='c319bed12b081f99e03324cf95925b1e139b2f14'
repo='ContextualWisdomLab/pg-erd-cloud'
pr='744'
echo '== Pull request range and changed files =='
gh pr view "$pr" --repo "$repo" --json headRefOid,baseRefOid,changedFiles,files,commits \
--jq '{headRefOid, baseRefOid, changedFiles, files: [.files[] | {path, additions, deletions}], commits: [.commits[] | {oid, messageHeadline}]}'
base_sha="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq .baseRefOid)"
echo "base_sha=$base_sha"
git diff --no-ext-diff --stat "$base_sha" "$expected_sha"
git diff --no-ext-diff --name-status "$base_sha" "$expected_sha"
git diff --no-ext-diff "$base_sha" "$expected_sha"
echo '== Production application CORS context =='
ast-grep outline backend/app/main.py --items all || true
nl -ba backend/app/main.py | sed -n '90,150p'
echo '== Locate and inspect CORS regression tests =='
fd -t f . backend | while IFS= read -r path; do
if rg -n -i -e 'preflight|cors|access-control-request-method|allow_methods' "$path" >/dev/null; then
echo "--- $path ---"
rg -n -i -C 8 -e 'preflight|cors|access-control-request-method|allow_methods' "$path"
fi
done
echo '== Exact-head check runs =='
gh api "repos/$repo/commits/$expected_sha/check-runs?per_page=100" \
--jq '.check_runs[] | {name, head_sha, status, conclusion, details_url}'
echo '== Exact-head legacy commit status =='
gh api "repos/$repo/commits/$expected_sha/status" \
--jq '{sha, state, statuses: [.statuses[] | {context, state, target_url}]}'
echo '== Reviews and unresolved threads =='
gh api "repos/$repo/pulls/$pr/reviews?per_page=100" \
--jq '.[] | {user: .user.login, state, commit_id, submitted_at, body}'
gh api graphql -F owner='ContextualWisdomLab' -F name='pg-erd-cloud' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
originalLine
comments(first: 20) {
nodes { author { login } body url createdAt }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] |
select(.isResolved == false) |
{isOutdated, path, line, originalLine, comments}'Length of output: 7128 🏁 Script executed: #!/bin/bash
set -u
expected_sha='c319bed12b081f99e03324cf95925b1e139b2f14'
repo='ContextualWisdomLab/pg-erd-cloud'
pr='744'
echo '== CORS constants and middleware order =='
sed -n '60,145p' backend/app/main.py
echo '== CORS regression test =='
sed -n '1,120p' backend/tests/test_cors_methods.py
echo '== All application middleware registrations =='
git grep -n -E 'app\.add_middleware|app\.middleware\(' "$expected_sha" -- backend/app/main.py || true
echo '== Exact-head check runs =='
gh api "repos/$repo/commits/$expected_sha/check-runs?per_page=100" \
--jq '.check_runs[] | {name, head_sha, status, conclusion, started_at, completed_at}' || true
echo '== Exact-head commit status =='
gh api "repos/$repo/commits/$expected_sha/status" \
--jq '{sha, state, statuses: [.statuses[] | {context, state}]}' || true
echo '== Pull request review decision and review records =='
gh pr view "$pr" --repo "$repo" --json reviewDecision,mergeStateStatus,statusCheckRollup \
--jq '{reviewDecision, mergeStateStatus, statusCheckRollup: [.statusCheckRollup[] | {name, status, conclusion}]}'
gh api "repos/$repo/pulls/$pr/reviews?per_page=100" \
--jq '.[] | {user: .user.login, state, commit_id, submitted_at}' || true
echo '== Count and list unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='pg-erd-cloud' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
originalLine
comments(first: 20) {
nodes { author { login } body url }
}
}
}
}
}
}' --jq '
[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] |
{unresolved_count: length, threads: .}' || trueLength of output: 14755
GitHub still reports
|
|
@opencode-agent Please review exact current head |
|
@cwl-noema-review Please independently review exact current head |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/pg-erd-cloud'
pr='744'
head='c319bed12b081f99e03324cf95925b1e139b2f14'
echo '== Exact checkout and commit =='
git rev-parse HEAD
git show --no-ext-diff --format='commit=%H%nparents=%P%nsubject=%s' --stat "$head"
git diff-tree --no-commit-id --name-status -r "$head"
echo '== PR range and diff =='
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq -r .baseRefOid)"
echo "base=$base"
gh pr view "$pr" --repo "$repo" --json headRefOid,changedFiles,files,reviewDecision,mergeStateStatus \
--jq '{headRefOid, changedFiles, files: [.files[] | {path, additions, deletions}], reviewDecision, mergeStateStatus}'
git diff --no-ext-diff "$base" "$head"
echo '== Production configuration and regression test =='
ast-grep outline backend/app/main.py --items all
ast-grep outline backend/tests/test_cors_methods.py --items all
nl -ba backend/app/main.py | sed -n '1,180p'
nl -ba backend/tests/test_cors_methods.py | sed -n '1,220p'
echo '== API route methods in production application =='
rg -n -P '@\w+\.(get|post|put|patch|delete|options)\s*\(' backend/app -g '*.py'
echo '== Middleware registrations =='
rg -n -C 3 -P '\b(add_middleware|middleware)\s*\(' backend/app/main.py
echo '== Exact-head checks =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name, head_sha, status, conclusion}]'
gh api "repos/$repo/commits/$head/status" \
--jq '{sha, state, statuses: [.statuses[] | {context, state}]}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='pg-erd-cloud' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line originalLine }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 2675 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/pg-erd-cloud'
pr='744'
head='c319bed12b081f99e03324cf95925b1e139b2f14'
echo '== Pull request metadata and full file scope =='
pr_json="$(gh api "repos/$repo/pulls/$pr")"
base="$(jq -r .base.sha <<<"$pr_json")"
api_head="$(jq -r .head.sha <<<"$pr_json")"
jq '{number, state, merged, mergeable_state, changed_files, base: .base.sha, head: .head.sha}' <<<"$pr_json"
echo "base=$base"
echo "head=$api_head"
gh api --paginate "repos/$repo/pulls/$pr/files?per_page=100" \
--jq '.[] | {filename, status, additions, deletions}'
echo '== Full pull request diff =='
git diff --no-ext-diff --stat "$base" "$head"
git diff --no-ext-diff --name-status "$base" "$head"
git diff --no-ext-diff "$base" "$head"
echo '== Production configuration and regression test =='
ast-grep outline backend/app/main.py --items all
ast-grep outline backend/tests/test_cors_methods.py --items all
nl -ba backend/app/main.py | sed -n '1,180p'
nl -ba backend/tests/test_cors_methods.py | sed -n '1,220p'
echo '== API route methods =='
rg -n -P '@\w+\.(get|post|put|patch|delete|options)\s*\(' backend/app -g '*.py' || true
echo '== Middleware registrations =='
rg -n -C 3 -P '\b(add_middleware|middleware)\s*\(' backend/app/main.py || true
echo '== Exact-head check runs =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name, head_sha, status, conclusion}]'
gh api "repos/$repo/commits/$head/status" \
--jq '{sha, state, statuses: [.statuses[] | {context, state}]}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='pg-erd-cloud' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line originalLine }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 6989 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/pg-erd-cloud'
pr='744'
head='c319bed12b081f99e03324cf95925b1e139b2f14'
echo '== CORS policy and middleware order =='
sed -n '60,175p' backend/app/main.py
echo '== Middleware registrations =='
rg -n -C 3 -P '\b(add_middleware|middleware)\s*\(' backend/app/main.py || true
echo '== Regression test =='
sed -n '1,180p' backend/tests/test_cors_methods.py
echo '== Route decorators by method =='
rg -n -P '@\w+\.(get|post|put|patch|delete|options)\s*\(' backend/app -g '*.py' || true
echo '== Exact-head check runs =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name, head_sha, status, conclusion}]'
echo '== Exact-head legacy commit status =='
gh api "repos/$repo/commits/$head/status" \
--jq '{sha, state, statuses: [.statuses[] | {context, state}]}'
echo '== Pull request reviews =='
gh api "repos/$repo/pulls/$pr/reviews?per_page=100" \
--jq '[.[] | {user: .user.login, state, commit_id, submitted_at}]'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='pg-erd-cloud' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line originalLine }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 15732 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Server-side PATCH registrations =='
rg -n -i -C 3 -P '\bpatch\s*=|\bmethods\s*=\s*\[[^]]*["'\'']PATCH["'\'']|\.patch\s*\(' backend -g '*.py' || true
echo '== Client-side PATCH requests =='
rg -n -i -C 3 -P '\bmethod\s*:\s*["'\'']PATCH["'\'']|\bmethod\s*=\s*["'\'']PATCH["'\'']|\.patch\s*\(' \
-g '*.{ts,tsx,js,jsx,py}' . || true
echo '== General PATCH references outside dependencies =='
rg -n -i -C 2 '\bPATCH\b' \
-g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' . || trueLength of output: 20412
This makes the allowlist broader than the verified production API surface. It does not meet the requested fail-closed boundary. Remove
You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review the exact current head only. Verify real browser preflight coverage for GET, POST, PUT, PATCH, DELETE, and OPTIONS; explicit method allowlisting; unchanged origin/header/credential/middleware behavior; and zero unrelated drift. Please submit a formal current-head verdict. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/pg-erd-cloud'
pr='744'
head='c319bed12b081f99e03324cf95925b1e139b2f14'
echo '== Exact checkout and PR metadata =='
printf 'checkout='; git rev-parse HEAD
gh api "repos/$repo/pulls/$pr" --jq \
'{number, state, draft, base: .base.sha, head: .head.sha, changed_files, mergeable_state}'
base="$(gh api "repos/$repo/pulls/$pr" --jq -r .base.sha)"
echo "base=$base"
echo '== Full PR scope and diff =='
git diff --no-ext-diff --name-status "$base" "$head"
git diff --no-ext-diff "$base" "$head"
echo '== CORS configuration and middleware registrations =='
ast-grep outline backend/app/main.py --items all
nl -ba backend/app/main.py | sed -n '1,220p'
rg -n -C 4 -P '\b(add_middleware|middleware)\s*\(' backend/app -g '*.py'
echo '== CORS regression test =='
ast-grep outline backend/tests/test_cors_methods.py --items all
nl -ba backend/tests/test_cors_methods.py | sed -n '1,220p'
echo '== HTTP method declarations and client HTTP method usage =='
rg -n -i -C 3 -P \
'(@\w+\.(get|post|put|patch|delete|options)\s*\(|\bmethods\s*=\s*\[[^]]*(GET|POST|PUT|PATCH|DELETE|OPTIONS)|\bmethod\s*[:=]\s*["'\''](GET|POST|PUT|PATCH|DELETE|OPTIONS)["'\''])' \
-g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' .
echo '== Exact-head checks =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name, head_sha, status, conclusion}]'
gh api "repos/$repo/commits/$head/status" \
--jq '{sha, state, statuses: [.statuses[] | {context, state}]}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='pg-erd-cloud' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line originalLine }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 2630 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/pg-erd-cloud'
pr='744'
head='c319bed12b081f99e03324cf95925b1e139b2f14'
echo '== PR file scope and patches =='
gh api --paginate "repos/$repo/pulls/$pr/files?per_page=100" \
--jq '.[] | {filename, status, additions, deletions, patch}'
echo '== Production CORS configuration =='
nl -ba backend/app/main.py | sed -n '1,220p'
echo '== Production middleware registrations =='
rg -n -C 4 -P '\b(add_middleware|middleware)\s*\(' backend/app -g '*.py' || true
echo '== CORS regression test =='
nl -ba backend/tests/test_cors_methods.py | sed -n '1,220p'
echo '== Server route declarations, including router registrations =='
rg -n -i -C 3 -P \
'(@\w+\.(get|post|put|patch|delete|options)\s*\(|\bmethods\s*=\s*\[[^]]*(GET|POST|PUT|PATCH|DELETE|OPTIONS)|\b(add_api_route|api_route)\s*\()' \
backend -g '*.py' || true
echo '== Client request method declarations =='
rg -n -i -C 3 -P \
'\bmethod\s*:\s*["'\''](GET|POST|PUT|PATCH|DELETE|OPTIONS)["'\'']|\bmethod\s*=\s*["'\''](GET|POST|PUT|PATCH|DELETE|OPTIONS)["'\'']|\.(get|post|put|patch|delete)\s*\(' \
-g '*.{ts,tsx,js,jsx}' -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' . || true
echo '== Exact-head checks =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name, head_sha, status, conclusion}]'
gh api "repos/$repo/commits/$head/status" \
--jq '{sha, state, statuses: [.statuses[] | {context, state}]}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='pg-erd-cloud' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line originalLine }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 4024 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/pg-erd-cloud'
pr='744'
head='c319bed12b081f99e03324cf95925b1e139b2f14'
parent="$(gh api "repos/$repo/commits/$head" --jq -r '.parents[0].sha')"
echo "parent=$parent"
echo '== Current CORS configuration and middleware order =='
sed -n '70,165p' backend/app/main.py
rg -n -C 5 -P '\b(app\.add_middleware|app\.middleware)\s*\(' backend/app/main.py || true
echo '== Parent CORS configuration =='
gh api "repos/$repo/contents/backend/app/main.py?ref=$parent" --jq -r .content \
| tr -d '\n' | base64 -d | sed -n '70,165p'
echo '== Regression test =='
sed -n '1,160p' backend/tests/test_cors_methods.py
echo '== Backend route and router method declarations =='
rg -n -i -C 3 -P \
'(@\w+\.(get|post|put|patch|delete|options)\s*\(|\bmethods\s*=\s*\[[^]]*(GET|POST|PUT|PATCH|DELETE|OPTIONS)|\b(add_api_route|api_route)\s*\()' \
backend -g '*.py' || true
echo '== PATCH-specific evidence outside the new CORS patch =='
rg -n -i -C 3 '\bPATCH\b|\.patch\s*\(' \
-g '!backend/app/main.py' -g '!backend/tests/test_cors_methods.py' \
-g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' . || true
echo '== Exact-head checks =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name, head_sha, status, conclusion}]'
gh api "repos/$repo/commits/$head/status" \
--jq '{sha, state, statuses: [.statuses[] | {context, state}]}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='pg-erd-cloud' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line originalLine }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 2243 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/pg-erd-cloud'
pr='744'
head='c319bed12b081f99e03324cf95925b1e139b2f14'
base='72afe6db712b145baaba084f64a1ff4fb36d9fd0'
echo '== Current CORS configuration and middleware order =='
sed -n '70,165p' backend/app/main.py
rg -n -C 5 -P '\b(app\.add_middleware|app\.middleware)\s*\(' backend/app/main.py || true
echo '== Parent CORS configuration =='
gh api "repos/$repo/contents/backend/app/main.py?ref=$base" --jq '.content' \
| tr -d '\n' | base64 -d | sed -n '70,165p'
echo '== Regression test =='
sed -n '1,160p' backend/tests/test_cors_methods.py
echo '== Backend route and router method declarations =='
rg -n -i -C 3 -P \
'(@\w+\.(get|post|put|patch|delete|options)\s*\(|\bmethods\s*=\s*\[[^]]*(GET|POST|PUT|PATCH|DELETE|OPTIONS)|\b(add_api_route|api_route)\s*\()' \
backend -g '*.py' || true
echo '== PATCH-specific evidence outside the new CORS patch =='
rg -n -i -C 3 '\bPATCH\b|\.patch\s*\(' \
-g '!backend/app/main.py' -g '!backend/tests/test_cors_methods.py' \
-g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' . || true
echo '== Exact-head checks =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name, head_sha, status, conclusion}]'
gh api "repos/$repo/commits/$head/status" \
--jq '{sha, state, statuses: [.statuses[] | {context, state}]}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='pg-erd-cloud' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line originalLine }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 66830
The regression verifies preflight handling for each configured method. It does not verify that each method is part of the production API surface. Therefore, Remove All other requested conditions are satisfactory:
You are interacting with an AI system. |
|
Exact-head independent review requested for |
|
@opencode-agent review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/pg-erd-cloud'
pr='744'
head='6ecb76fe10b76cc1c1359d5fa2a7ee497cdd5980'
echo '== Requested commit and pull request metadata =='
printf 'checkout='; git rev-parse HEAD
gh api "repos/$repo/pulls/$pr" --jq \
'{number, state, draft, base: .base.sha, head: .head.sha, changed_files, mergeable_state}'
base="$(gh api "repos/$repo/pulls/$pr" --jq -r .base.sha)"
echo "base=$base"
echo '== Pull request scope and complete diff =='
git diff --no-ext-diff --stat "$base" "$head"
git diff --no-ext-diff --name-status "$base" "$head"
git diff --no-ext-diff "$base" "$head"
echo '== Changed file structure =='
ast-grep outline backend/app/main.py --items all
ast-grep outline backend/tests/test_cors_methods.py --items all
echo '== Production CORS configuration and middleware registration =='
nl -ba backend/app/main.py | sed -n '60,180p'
rg -n -C 4 -P '\b(app\.add_middleware|app\.middleware)\s*\(' backend/app/main.py
echo '== CORS regression test =='
nl -ba backend/tests/test_cors_methods.py | sed -n '1,220p'
echo '== Registered API methods =='
rg -n -i -C 2 -P \
'(@\w+\.(get|post|put|patch|delete|options)\s*\(|\bmethods\s*=\s*\[[^]]*(GET|POST|PUT|PATCH|DELETE|OPTIONS)|\b(add_api_route|api_route)\s*\()' \
backend -g '*.py' || true
echo '== Exact-head checks =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name, head_sha, status, conclusion}]'
gh api "repos/$repo/commits/$head/status" \
--jq '{sha, state, statuses: [.statuses[] | {context, state}]}'
echo '== Reviews and unresolved threads =='
gh api "repos/$repo/pulls/$pr/reviews?per_page=100" \
--jq '[.[] | {user: .user.login, state, commit_id, submitted_at}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='pg-erd-cloud' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line originalLine }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 2796 🏁 Script executed: #!/bin/bash
set -u
repo='ContextualWisdomLab/pg-erd-cloud'
pr='744'
head='6ecb76fe10b76cc1c1359d5fa2a7ee497cdd5980'
echo '== Full PR file scope and patches =='
gh api --paginate "repos/$repo/pulls/$pr/files?per_page=100" \
--jq '.[] | {filename, status, additions, deletions, patch}'
echo '== Production CORS configuration and middleware registration =='
nl -ba backend/app/main.py | sed -n '60,180p'
rg -n -C 4 -P '\b(app\.add_middleware|app\.middleware)\s*\(' backend/app/main.py || true
echo '== CORS regression test =='
nl -ba backend/tests/test_cors_methods.py | sed -n '1,220p'
echo '== Registered backend route methods =='
rg -n -i -C 2 -P \
'(@\w+\.(get|post|put|patch|delete|options)\s*\(|\bmethods\s*=\s*\[[^]]*(GET|POST|PUT|PATCH|DELETE|OPTIONS)|\b(add_api_route|api_route)\s*\()' \
backend -g '*.py' || true
echo '== Exact-head check runs and status contexts =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name, head_sha, status, conclusion}]' || true
gh api "repos/$repo/commits/$head/status" \
--jq '{sha, state, statuses: [.statuses[] | {context, state}]}' || true
echo '== Current reviews and unresolved review threads =='
gh api "repos/$repo/pulls/$pr/reviews?per_page=100" \
--jq '[.[] | {user: .user.login, state, commit_id, submitted_at}]' || true
gh api graphql -F owner='ContextualWisdomLab' -F name='pg-erd-cloud' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line originalLine }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]' || trueLength of output: 28830
I found no blocking issue.
[approve] You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review Please review exact head |
1 participant
Problem
The production CORS middleware permitted only
GET,POST, andOPTIONS, while the registered API and frontend also usePUTandDELETE. Browsers therefore rejected valid cross-origin mutations during preflight. The repository currently exposes noPATCHroute, soPATCHmust remain denied rather than being pre-authorized speculatively.Implemented fix
GET,POST,PUT,DELETE, andOPTIONS;PATCHrequests receive a400preflight response and are absent fromAccess-Control-Allow-Methods;dd096deb87e6f07d8a2a15ca7f935c3012f3d166), before tightening production configuration;*;PUTandDELETEto the productionCORSMiddlewareconfiguration while keepingPATCHdenied;This clean replacement supersedes closed #694, whose final branch no longer contained the advertised CORS change and had accumulated unrelated rate-limiter work.
Exact-head validation
Current head:
6ecb76fe10b76cc1c1359d5fa2a7ee497cdd5980.Exact-head CI, security gates, automated review, unresolved threads, and independent non-author approval must be revalidated after the current-head fix. The PR must not merge until repository policy and every required gate pass on this exact head.