Upstream fix image cdn cors

[WilfordGrimley]

Description

Problem

The OPTIONS preflight handler (src/handler/cors.ts) sets Access-Control-Allow-Origin, but the real GET responses never do. small/large (served via R2Service) have no CORS header at all, so cross-origin fetch() calls - both the PDF live preview and, from within the PDF-render Worker, any consumer fetching these images - fail outright in every browser.

This isn't theoretical - it's reproducible against the live deployment right now:

  $ curl -sD - -o /dev/null "https://cdn.mpcautofill.com/images/google_drive/small/<id>.jpg" | grep -i access-control
  (no output - header is absent)

  $ curl -sD - -o /dev/null "https://cdn.mpcautofill.com/images/google_drive/full/<id>.jpg" | grep -i access-control
  access-control-allow-origin: *

full only "works" by accident: that header is Google's own response passing through unmodified, not something this Worker sets itself - so it's not something to depend on, and doesn't help small/large at all since those are served from R2 via a locally-constructed Response with no such header. Confirmed the failure mode end-to-end (an isolated main-thread + Worker fetch() test, no test-harness CORS shim) against my own deployment of this same code, in both real Firefox and Chromium.

Fix

Add the header to every actual image response in handleImageRequest, not just the OPTIONS preflight. Also adds a small readme for image-cdn/, which had no documentation at all.

Tests

Added regression tests covering all three size tiers against a mocked upstream response that deliberately carries no CORS header of its own, so this can't silently regress again. Full suite: 48 passed.

Found and fixed while working on a fork (ProxyPrints) - happy to adjust anything to match this repo's conventions.
EOF)

Problem

The OPTIONS preflight handler (src/handler/cors.ts) sets Access-Control-Allow-Origin, but the real GET responses never do. small/large (served via R2Service) have no CORS header at all, so cross-origin fetch() calls - both the PDF live preview and, from within the PDF-render Worker, any consumer fetching these images - fail outright in every browser.

This isn't theoretical - it's reproducible against the live deployment right now:

$ curl -sD - -o /dev/null "https://cdn.mpcautofill.com/images/google_drive/small/<id>.jpg" | grep -i access-control
(no output - header is absent)

$ curl -sD - -o /dev/null "https://cdn.mpcautofill.com/images/google_drive/full/<id>.jpg" | grep -i access-control
access-control-allow-origin: *

full only "works" by accident: that header is Google's own response passing through unmodified, not something this Worker sets itself - so it's not something to depend on, and doesn't help small/large at all since those are served from R2 via a locally-constructed Response with no such header. Confirmed the failure mode end-to-end (an isolated main-thread + Worker fetch() test, no test-harness CORS shim) against my own deployment of this same code, in both real Firefox and Chromium.

Fix

Add the header to every actual image response in handleImageRequest, not just the OPTIONS preflight. Also adds a small readme for image-cdn/, which had no documentation at all.

Tests

Added regression tests covering all three size tiers against a mocked upstream response that deliberately carries no CORS header of its own, so this can't silently regress again. Full suite: 48 passed.

Found and fixed while working on a fork (ProxyPrints) - happy to adjust anything to match this repo's conventions.

Checklist

• I have installed pre-commit and installed the hooks with pre-commit install before creating any commits.
• I have updated any related tests for code I modified or added new tests where appropriate.
• I have manually tested my changes as follows:
• I have updated any relevant documentation or created new documentation where appropriate.

[ndepaola]

I'm working on a set of changes which refactors the image CDN pretty heavily & will also fix CORS for GET requests, will probs close this PR to avoid merge conflicts - thanks though!

[WilfordGrimley]

I'm working on a set of changes which refactors the image CDN pretty heavily & will also fix CORS for GET requests, will probs close this PR to avoid merge conflicts - thanks though!

Awesome! Will any amount of it be cached locally, or still rely on CloudFlare