Handle OPTIONS

[rpj]

CORS is broken for servers using this software, and accordingly hosted boards can't be displayed in external clients like @robinsloan's -- thank you for the heads up Robin! This was just an oversight on my part. "(Mostly) conforming..." 😉

Relevant section in the spec for reference.

[rpj]

Ah that's right, there's even a module for this! https://github.com/fastify/fastify-cors

And I've even used it before, so I really shouldn't have missed this... 🤦‍♂️

[rpj]

Internet down at the office, including VPN, which means access to everything I need to get work done. 😦

But I guess I can get this taken care of now at least!

[rpj]

100% reproducible on main indeed:

$ curl -v -H "Origin: https://example.com" -H "Access-Control-Request-Method: GET" -H "Access-Control-Request-Headers: spring-signature, spring-version" -X OPTIONS https://0l0.lol/
...
> OPTIONS / HTTP/2
> Host: 0l0.lol
> user-agent: curl/7.82.0
> accept: */*
> origin: https://example.com
> access-control-request-method: GET
> access-control-request-headers: spring-signature, spring-version
>
...
< HTTP/2 404

Same request but on the fix branch:

> OPTIONS / HTTP/2
> Host: 0l0.lol
> user-agent: curl/7.82.0
> accept: */*
> origin: https://example.com
> access-control-request-method: GET
> access-control-request-headers: spring-signature, spring-version
>
...
< HTTP/2 204
< access-control-allow-headers: Content-Type, If-Modified-Since, Spring-Signature, Spring-Version
< access-control-allow-methods: GET, PUT
< access-control-allow-origin: *
< access-control-expose-headers: Content-Type, Last-Modified, spring-difficulty, spring-signature, spring-version