From 62e63e441a7da9b11218999e97ef3ad048381a48 Mon Sep 17 00:00:00 2001
From: Hermes Agent <bruno.charest@gmail.com>
Date: Thu, 25 Jun 2026 15:33:02 -0400
Subject: [PATCH] =?UTF-8?q?fix:=20CORS=20layer=20=E2=80=94=20corrige=20'se?=
 =?UTF-8?q?rveur=20injoignable'=20dans=20le=20navigateur?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Ajout CorsLayer::permissive() au router axum
- Répond aux requêtes OPTIONS (preflight CORS)
- Le header X-API-Key rendait les requêtes non-simples → preflight obligatoire
- Sans réponse OPTIONS, le navigateur bloquait → 'Failed to fetch'
- Curl fonctionnait car pas de preflight
---
 src/frontend/changelog.html | 6 +++---
 src/frontend/help.html      | 6 +++---
 src/frontend/index.html     | 2 +-
 src/server/mod.rs           | 6 ++++--
 4 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/src/frontend/changelog.html b/src/frontend/changelog.html
index b80a602..eb015f6 100644
--- a/src/frontend/changelog.html
+++ b/src/frontend/changelog.html
@@ -3,7 +3,7 @@
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>Changelog — imagod-web v0.2.0+build.25-41fcb23-dirty</title>
+<title>Changelog — imagod-web v0.2.0+build.26-4917dad-dirty</title>
 <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🖼️</text></svg>">
 <style>
 * { margin:0; padding:0; box-sizing:border-box; }
@@ -37,7 +37,7 @@ footer { text-align:center; color:#484f58; font-size:0.8rem; padding:2rem; }
 </head>
 <body>
 <header>
-  <h1>📋 imagod-web <span class="version-badge">v0.2.0+build.25-41fcb23-dirty</span></h1>
+  <h1>📋 imagod-web <span class="version-badge">v0.2.0+build.26-4917dad-dirty</span></h1>
   <nav>
     <a href="/">🖼️ Galerie</a>
     <a href="/changelog" class="active">📋 Changelog</a>
@@ -107,6 +107,6 @@ footer { text-align:center; color:#484f58; font-size:0.8rem; padding:2rem; }
 <h2>Légende des tags</h2>
 
 </main>
-<footer>imagod-web v0.2.0+build.25-41fcb23-dirty — <a href="https://git.dracodev.net/Projets/imagod-web">Gitea</a></footer>
+<footer>imagod-web v0.2.0+build.26-4917dad-dirty — <a href="https://git.dracodev.net/Projets/imagod-web">Gitea</a></footer>
 </body>
 </html>
diff --git a/src/frontend/help.html b/src/frontend/help.html
index 5b66e6a..0b6e075 100644
--- a/src/frontend/help.html
+++ b/src/frontend/help.html
@@ -3,7 +3,7 @@
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>Aide & Roadmap — imagod-web v0.2.0+build.25-41fcb23-dirty</title>
+<title>Aide & Roadmap — imagod-web v0.2.0+build.26-4917dad-dirty</title>
 <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🖼️</text></svg>">
 <style>
 * { margin:0; padding:0; box-sizing:border-box; }
@@ -37,7 +37,7 @@ footer { text-align:center; color:#484f58; font-size:0.8rem; padding:2rem; }
 </head>
 <body>
 <header>
-  <h1>❓ imagod-web <span class="version-badge">v0.2.0+build.25-41fcb23-dirty</span></h1>
+  <h1>❓ imagod-web <span class="version-badge">v0.2.0+build.26-4917dad-dirty</span></h1>
   <nav>
     <a href="/">🖼️ Galerie</a>
     <a href="/changelog">📋 Changelog</a>
@@ -169,6 +169,6 @@ footer { text-align:center; color:#484f58; font-size:0.8rem; padding:2rem; }
 <p>5. <strong>Corriger le backend Imago</strong> (thumbnails, upload, stockage)</p>
 
 </main>
-<footer>imagod-web v0.2.0+build.25-41fcb23-dirty — <a href="https://git.dracodev.net/Projets/imagod-web">Gitea</a></footer>
+<footer>imagod-web v0.2.0+build.26-4917dad-dirty — <a href="https://git.dracodev.net/Projets/imagod-web">Gitea</a></footer>
 </body>
 </html>
diff --git a/src/frontend/index.html b/src/frontend/index.html
index b3f5457..67f31a4 100644
--- a/src/frontend/index.html
+++ b/src/frontend/index.html
@@ -465,7 +465,7 @@
         <button class="btn" id="clear-btn" style="display:none">✕</button>
     </div>
     <button class="btn accent" id="header-upload-btn" onclick="document.getElementById('drop-zone').scrollIntoView({behavior:'smooth'}); document.getElementById('file-input').click()">📤 Upload</button>
-    <span class="version-badge" id="version-badge">v0.2.0+build.25-41fcb23-dirty</span>
+    <span class="version-badge" id="version-badge">v0.2.0+build.26-4917dad-dirty</span>
 </div>
 
 <!-- ─── Navigation ─── -->
diff --git a/src/server/mod.rs b/src/server/mod.rs
index d5fbed6..395e55e 100644
--- a/src/server/mod.rs
+++ b/src/server/mod.rs
@@ -11,6 +11,7 @@ use std::net::SocketAddr;
 use std::sync::Arc;
 use std::collections::HashSet;
 use tokio::sync::Mutex;
+use tower_http::cors::CorsLayer;
 use crate::imago_client::ImagoClient;
 use crate::config::Config;
 
@@ -54,11 +55,12 @@ pub async fn serve_with_config(host: &str, port: u16, config: &Config) -> anyhow
         in_flight: Mutex::new(HashSet::new()),
     };
 
-    // Router principal
+    // Router principal — avec CORS permissif pour les requêtes cross-origin et preflight
     let app = Router::new()
         .merge(routes::api_routes(state))
         .route("/ws", axum::routing::get(ws::ws_handler).with_state(ws_hub))
-        .fallback(serve_static);
+        .fallback(serve_static)
+        .layer(CorsLayer::permissive());
 
     let addr: SocketAddr = format!("{}:{}", host, port).parse()?;
     tracing::info!("Dashboard web démarré sur http://{}", addr);