[www] add basic room list

apps/rooms/src/rooms.app.ts

@@ -50,12 +50,19 @@ import {
 	unbanPlayerFromRoom,
 	updateRoomFields,
 } from '@repo/domain'
-import { intVar, logger, withCleanSpec, withNotFound, withOnError } from '@repo/hono-helpers'
+import {
+	intVar,
+	logger,
+	withCleanSpec,
+	withDefaultCors,
+	withNotFound,
+	withOnError,
+} from '@repo/hono-helpers'
 import { validateAndGetAccountId, validateAndGetRoles } from '@repo/jwt'
+
 // The notification-type ids the hub carries (owned by the `notify` worker). Imported
 // as a value — the enum has no runtime dependencies.
 import { NotificationType } from '../../notify/src/notification-types'
-
 import {
 	AccessibilityRequest,
 	AUTHED,
@@ -85,8 +92,8 @@ import {
 	PublishSaveRequest,
 	RestrictionsRequest,
 	RoleRequest,
-	RoomBanEnvelope,
 	RoomBanEntryDto,
+	RoomBanEnvelope,
 	RoomDto,
 	RoomEnvelope,
 	roomIdParam,
@@ -546,6 +553,15 @@ const app = new Hono<App>()
 			})(c, next)
 	)
 
+	// The website (`www`) is a browser origin calling these endpoints directly, the way
+	// rec.net's own site called the game's API — its "My rooms" list is this worker's
+	// `GET /rooms/ownedby/me` — so the responses need CORS headers or the browser
+	// discards them. `origin: '*'` is deliberate and safe HERE because these endpoints
+	// authenticate with a bearer token in the `Authorization` header, never a cookie: a
+	// hostile page can't read another origin's stored token, so there is no ambient
+	// credential for `*` to expose. Do not add cookie auth without narrowing it.
+	.use('*', withDefaultCors())
+
 	.onError(withOnError())
 	.notFound(withNotFound())