From 7556cd0bee55b0d2d27c2de35d3df8b5b3c7857e Mon Sep 17 00:00:00 2001
From: bruno <bruno.charest@gmail.com>
Date: Wed, 28 Oct 2026 13:45:33 -0400
Subject: [PATCH] Tests CORS recherche : prod+dev autorises, tiers refuse

---
 tests/test_recherche.py | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/tests/test_recherche.py b/tests/test_recherche.py
index ecf6d1c..a484bcc 100644
--- a/tests/test_recherche.py
+++ b/tests/test_recherche.py
@@ -34,7 +34,13 @@ def test_origin_of():
 
 
 def test_sister_origins_dev():
+    # Correctif 2026-10-28 : 8 origines officielles, prod ET dev,
+    # quelle que soit la résolution.
     assert sister_origins(RESOLVED_DEV) == {
+        "https://og.dracodev.net",
+        "https://flowdeck.dracodev.net",
+        "https://tiktak.dracodev.net",
+        "https://kanbante.dracodev.net",
         "https://og-dev.dracodev.net",
         "https://flowdeck-dev.dracodev.net",
         "https://tiktak-dev.dracodev.net",
@@ -47,7 +53,11 @@ def test_cors_headers():
     assert headers["Access-Control-Allow-Origin"] == "https://tiktak-dev.dracodev.net"
     assert headers["Access-Control-Allow-Credentials"] == "true"
     assert cors_headers_for("https://evil.example", RESOLVED_DEV) is None
-    assert cors_headers_for("https://og.dracodev.net", RESOLVED_DEV) is None
+    assert cors_headers_for("https://og-dev.dracodev.net.evil.example",
+                            RESOLVED_DEV) is None
+    # Autre environnement autorisé (correctif 2026-10-28).
+    assert cors_headers_for("https://og.dracodev.net",
+                            RESOLVED_DEV) is not None
 
 
 def test_preflight_headers():
@@ -86,7 +96,14 @@ def test_groupes_vers_json_vide():
 
 
 def test_sister_origins_hote_requete():
-    # Configuration muette + hôte dev : le repli inclut les -dev.
+    # Correctif 2026-10-28 : configuration muette, quel que soit
+    # l'hôte de la requête, prod ET dev passent.
     assert "https://og-dev.dracodev.net" in sister_origins(
         {}, request_host="kanbante-dev.dracodev.net"
     )
+    assert "https://og.dracodev.net" in sister_origins(
+        {}, request_host="kanbante-dev.dracodev.net"
+    )
+    assert "https://og-dev.dracodev.net" in sister_origins(
+        {}, request_host="kanbante.dracodev.net"
+    )