From 3c4bbbf2f13f558e27a4652f17ea11e44747f2bf Mon Sep 17 00:00:00 2001
From: bruno <bruno.charest@gmail.com>
Date: Wed, 28 Oct 2026 13:45:35 -0400
Subject: [PATCH] Tests CORS alertes : origine dev autorisee en preflight

---
 tests/test_draco_alertes.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tests/test_draco_alertes.py b/tests/test_draco_alertes.py
index 15ad7e4..d2e66f0 100644
--- a/tests/test_draco_alertes.py
+++ b/tests/test_draco_alertes.py
@@ -44,3 +44,10 @@ def test_cors_events_soeur_preflight_get_et_tiers(client):
                         headers={"Origin": "https://evil.example",
                                  "Access-Control-Request-Method": "GET"})
     assert "access-control-allow-origin" not in r3.headers
+    # Correctif 2026-10-28 : une origine sœur dev passe aussi.
+    r4 = client.options("/api/events",
+                        headers={"Origin": "https://tiktak-dev.dracodev.net",
+                                 "Access-Control-Request-Method": "GET"})
+    assert r4.status_code == 200
+    assert r4.headers.get("access-control-allow-origin") == "https://tiktak-dev.dracodev.net"
+    assert r4.headers.get("access-control-allow-credentials") == "true"