fix(cors): allow Office add-in origins (addin.postguard.eu + localhost:3000) and DELETE method

[dobby-coder]

Summary

Fixes the CORS failure reported in encryption4all/postguard#154: browser callers (pg-js inside the Office add-in) were blocked when reaching /fileupload/* and /filedownload/*, because the preflight returned no Access-Control-Allow-Origin. The production allowed_origins regex only matched the postguard.eu/postguard.nl website, so the add-in's origins never matched.

Changes

• conf/config.toml — extend the allowed_origins regex to also match the add-in origins from the issue, keeping the existing website origins:

  ^https://(postguard\.(eu|nl)|addin\.postguard\.eu|localhost:3000)$
  

  • https://addin.postguard.eu — Outlook add-in (prod)
  • https://localhost:3000 — Office add-in dev server
  • https://postguard.eu / https://postguard.nl — unchanged
• build_rocket CORS (src/main.rs) — add Method::Delete to allowed_methods, so the preflight advertises GET, POST, PUT, DELETE as requested. Access-Control-Allow-Headers already includes Content-Type and Authorization (plus Content-Range, CryptifyToken, Range, X-Recovery-Token, X-POSTGUARD-CLIENT-VERSION), so no header change was needed.

Tests

Two new integration tests boot the real build_rocket CORS fairing with the exact production regex (kept in a PROD_ALLOWED_ORIGINS const, a hand-maintained copy of the shipped regex):

• cors_preflight_allows_addin_and_localhost_origins — sends OPTIONS /fileupload/init from both add-in origins and asserts a 2xx preflight that echoes Access-Control-Allow-Origin, advertises all four methods, and lists Content-Type + Authorization.
• cors_preflight_rejects_unlisted_origin — asserts an unlisted origin gets no Access-Control-Allow-Origin header.

This is the in-process equivalent of the curl -i -X OPTIONS repro from the issue. Booting the standalone binary to curl it live isn't feasible here (it requires a reachable PKG server at startup), but the test drives the identical fairing + config path the curl would hit.

cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings, and cargo test --all-targets (127 passed) all pass locally.

Closes encryption4all/postguard#154

🤖 Generated with Claude Code