Tests CORS recherche : prod+dev autorises, tiers refuse

tests/test_recherche.py

@@ -34,7 +34,13 @@ def test_origin_of():
 
 
 def test_sister_origins_dev():
+    # Correctif 2026-10-28 : 8 origines officielles, prod ET dev,
+    # quelle que soit la résolution.
     assert sister_origins(RESOLVED_DEV) == {
+        "https://og.dracodev.net",
+        "https://flowdeck.dracodev.net",
+        "https://tiktak.dracodev.net",
+        "https://kanbante.dracodev.net",
         "https://og-dev.dracodev.net",
         "https://flowdeck-dev.dracodev.net",
         "https://tiktak-dev.dracodev.net",
@@ -47,7 +53,11 @@ def test_cors_headers():
     assert headers["Access-Control-Allow-Origin"] == "https://tiktak-dev.dracodev.net"
     assert headers["Access-Control-Allow-Credentials"] == "true"
     assert cors_headers_for("https://evil.example", RESOLVED_DEV) is None
-    assert cors_headers_for("https://og.dracodev.net", RESOLVED_DEV) is None
+    assert cors_headers_for("https://og-dev.dracodev.net.evil.example",
+                            RESOLVED_DEV) is None
+    # Autre environnement autorisé (correctif 2026-10-28).
+    assert cors_headers_for("https://og.dracodev.net",
+                            RESOLVED_DEV) is not None
 
 
 def test_preflight_headers():
@@ -86,7 +96,14 @@ def test_groupes_vers_json_vide():
 
 
 def test_sister_origins_hote_requete():
-    # Configuration muette + hôte dev : le repli inclut les -dev.
+    # Correctif 2026-10-28 : configuration muette, quel que soit
+    # l'hôte de la requête, prod ET dev passent.
     assert "https://og-dev.dracodev.net" in sister_origins(
         {}, request_host="kanbante-dev.dracodev.net"
     )
+    assert "https://og.dracodev.net" in sister_origins(
+        {}, request_host="kanbante-dev.dracodev.net"
+    )
+    assert "https://og-dev.dracodev.net" in sister_origins(
+        {}, request_host="kanbante.dracodev.net"
+    )