[www] beta room uploads (#34)

* WIP room uploads

* add beta warning

apps/storage/src/storage.app.ts

@@ -2,7 +2,7 @@ import { Hono } from 'hono'
 import { describeRoute, openAPIRouteHandler } from 'hono-openapi'
 import { useWorkersLogger } from 'workers-tagged-logger'
 
-import { withCleanSpec, withNotFound, withOnError } from '@repo/hono-helpers'
+import { withCleanSpec, withDefaultCors, withNotFound, withOnError } from '@repo/hono-helpers'
 import { validateAndGetAccountId } from '@repo/jwt'
 
 import {
@@ -79,6 +79,11 @@ const app = new Hono<App>()
 				release: c.env.SENTRY_RELEASE,
 			})(c, next)
 	)
+	// The game posts here with no Origin at all, but the website does too — it uploads a
+	// subroom's scene blob straight from the browser, the same way it calls `rooms` and
+	// `accounts` directly. An `Authorization` header makes that a preflighted request, so
+	// without this the OPTIONS gets a 404 and the upload never leaves the page.
+	.use('*', withDefaultCors())
 
 	.onError(withOnError())
 	.notFound(withNotFound())

apps/storage/src/test/integration/api.test.ts

@@ -160,6 +160,23 @@ it('POST /upload 400s when there is neither a file nor a name', async () => {
 	expect(res.status).toBe(400)
 })
 
+it('answers the CORS preflight the website’s upload needs', async () => {
+	// The room management page uploads a subroom's scene blob straight from the browser.
+	// The bearer token makes that a preflighted request, so a missing OPTIONS handler
+	// stops the upload before any of the tests above are even reached.
+	const res = await SELF.fetch(`${ORIGIN}/upload`, {
+		method: 'OPTIONS',
+		headers: {
+			Origin: 'https://www.example.com',
+			'Access-Control-Request-Method': 'POST',
+			'Access-Control-Request-Headers': 'authorization',
+		},
+	})
+	expect(res.status).toBe(204)
+	expect(res.headers.get('access-control-allow-origin')).toBe('*')
+	expect(res.headers.get('access-control-allow-headers')?.toLowerCase()).toContain('authorization')
+})
+
 it('GET /openapi.json documents every route', async () => {
 	const res = await SELF.fetch(`${ORIGIN}/openapi.json`)
 	expect(res.status).toBe(200)