tests/test_draco_alertes.py

@@ -61,3 +61,9 @@ def test_notifications_api_et_cors_soeur(client):
                         headers={"Origin": "https://evil.example",
                                  "Access-Control-Request-Method": "GET"})
     assert "access-control-allow-origin" not in r4.headers
+    # Correctif 2026-10-28 : une origine sœur dev passe aussi.
+    r5 = client.options("/api/notifications",
+                        headers={"Origin": "https://tiktak-dev.dracodev.net",
+                                 "Access-Control-Request-Method": "GET"})
+    assert r5.headers.get("access-control-allow-origin") == "https://tiktak-dev.dracodev.net"
+    assert r5.headers.get("access-control-allow-credentials") == "true"