Tests CORS recherche : prod+dev autorises, tiers refuse

tests/test_recherche.py

@@ -38,7 +38,13 @@ def test_origin_of():
 
 
 def test_sister_origins_dev():
+    # Correctif 2026-10-28 : 8 origines officielles, prod ET dev,
+    # quelle que soit la résolution.
     assert sister_origins(RESOLVED_DEV) == {
+        "https://og.dracodev.net",
+        "https://flowdeck.dracodev.net",
+        "https://tiktak.dracodev.net",
+        "https://kanbante.dracodev.net",
         "https://og-dev.dracodev.net",
         "https://flowdeck-dev.dracodev.net",
         "https://tiktak-dev.dracodev.net",
@@ -47,16 +53,21 @@ def test_sister_origins_dev():
 
 
 def test_sister_origins_ajoute_env_de_la_requete():
-    # Configuration muette (hors requête) + hôte dev : les -dev passent.
+    # Correctif 2026-10-28 : configuration muette, quel que soit
+    # l'hôte de la requête, prod ET dev passent — l'hôte ne
+    # restreint plus l'allowlist.
     assert "https://og-dev.dracodev.net" in sister_origins(
         {}, request_host="flowdeck-dev.dracodev.net"
     )
     assert "https://og.dracodev.net" in sister_origins(
         {}, request_host="flowdeck.dracodev.net"
     )
-    assert "https://og-dev.dracodev.net" not in sister_origins(
+    assert "https://og-dev.dracodev.net" in sister_origins(
         {}, request_host="flowdeck.dracodev.net"
     )
+    assert "https://og.dracodev.net" in sister_origins(
+        {}, request_host="flowdeck-dev.dracodev.net"
+    )
 
 
 def test_cors_headers():
@@ -64,7 +75,11 @@ def test_cors_headers():
     assert headers["Access-Control-Allow-Origin"] == "https://og-dev.dracodev.net"
     assert headers["Access-Control-Allow-Credentials"] == "true"
     assert cors_headers_for("https://evil.example", RESOLVED_DEV) is None
-    assert cors_headers_for("https://og.dracodev.net", RESOLVED_DEV) is None
+    assert cors_headers_for("https://og-dev.dracodev.net.evil.example",
+                            RESOLVED_DEV) is None
+    # Autre environnement autorisé (correctif 2026-10-28).
+    assert cors_headers_for("https://og.dracodev.net",
+                            RESOLVED_DEV) is not None
 
 
 def test_preflight_headers():