feat: add CORS support for browser clients

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

src/pds.js

···
   }
 }
 
-export default {
-  async fetch(request, env) {
-    const url = new URL(request.url)
+const corsHeaders = {
+  'Access-Control-Allow-Origin': '*',
+  'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+  'Access-Control-Allow-Headers': 'Content-Type, Authorization, atproto-accept-labelers',
+}
 
-    // Endpoints that don't require ?did= param (for relay/federation)
-    if (url.pathname === '/.well-known/atproto-did' ||
-        url.pathname === '/xrpc/com.atproto.server.describeServer') {
-      const did = url.searchParams.get('did') || 'default'
-      const id = env.PDS.idFromName(did)
-      const pds = env.PDS.get(id)
-      // Pass hostname for describeServer
-      const newReq = new Request(request.url, {
-        method: request.method,
-        headers: { ...Object.fromEntries(request.headers), 'x-hostname': url.hostname }
-      })
-      return pds.fetch(newReq)
-    }
+function addCorsHeaders(response) {
+  const newHeaders = new Headers(response.headers)
+  for (const [key, value] of Object.entries(corsHeaders)) {
+    newHeaders.set(key, value)
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: newHeaders
+  })
+}
 
-    // subscribeRepos WebSocket - route to default instance for firehose
-    if (url.pathname === '/xrpc/com.atproto.sync.subscribeRepos') {
-      const defaultId = env.PDS.idFromName('default')
-      const defaultPds = env.PDS.get(defaultId)
-      return defaultPds.fetch(request)
+export default {
+  async fetch(request, env) {
+    // Handle CORS preflight
+    if (request.method === 'OPTIONS') {
+      return new Response(null, { headers: corsHeaders })
     }
 
-    // listRepos needs to aggregate from all registered DIDs
-    if (url.pathname === '/xrpc/com.atproto.sync.listRepos') {
-      const defaultId = env.PDS.idFromName('default')
-      const defaultPds = env.PDS.get(defaultId)
-      const regRes = await defaultPds.fetch(new Request('http://internal/get-registered-dids'))
-      const { dids } = await regRes.json()
+    const response = await handleRequest(request, env)
+    return addCorsHeaders(response)
+  }
+}
 
-      const repos = []
-      for (const did of dids) {
-        const id = env.PDS.idFromName(did)
-        const pds = env.PDS.get(id)
-        const infoRes = await pds.fetch(new Request('http://internal/repo-info'))
-        const info = await infoRes.json()
-        if (info.head) {
-          repos.push({ did, head: info.head, rev: info.rev, active: true })
-        }
-      }
-      return Response.json({ repos, cursor: undefined })
-    }
+async function handleRequest(request, env) {
+  const url = new URL(request.url)
 
-    const did = url.searchParams.get('did')
-    if (!did) {
-      return new Response('missing did param', { status: 400 })
-    }
+  // Endpoints that don't require ?did= param (for relay/federation)
+  if (url.pathname === '/.well-known/atproto-did' ||
+      url.pathname === '/xrpc/com.atproto.server.describeServer') {
+    const did = url.searchParams.get('did') || 'default'
+    const id = env.PDS.idFromName(did)
+    const pds = env.PDS.get(id)
+    // Pass hostname for describeServer
+    const newReq = new Request(request.url, {
+      method: request.method,
+      headers: { ...Object.fromEntries(request.headers), 'x-hostname': url.hostname }
+    })
+    return pds.fetch(newReq)
+  }
 
-    // On init, also register this DID with the default instance
-    if (url.pathname === '/init' && request.method === 'POST') {
-      const body = await request.json()
+  // subscribeRepos WebSocket - route to default instance for firehose
+  if (url.pathname === '/xrpc/com.atproto.sync.subscribeRepos') {
+    const defaultId = env.PDS.idFromName('default')
+    const defaultPds = env.PDS.get(defaultId)
+    return defaultPds.fetch(request)
+  }
 
-      // Register with default instance for discovery
-      const defaultId = env.PDS.idFromName('default')
-      const defaultPds = env.PDS.get(defaultId)
-      await defaultPds.fetch(new Request('http://internal/register-did', {
-        method: 'POST',
-        body: JSON.stringify({ did })
-      }))
+  // listRepos needs to aggregate from all registered DIDs
+  if (url.pathname === '/xrpc/com.atproto.sync.listRepos') {
+    const defaultId = env.PDS.idFromName('default')
+    const defaultPds = env.PDS.get(defaultId)
+    const regRes = await defaultPds.fetch(new Request('http://internal/get-registered-dids'))
+    const { dids } = await regRes.json()
 
-      // Forward to the actual PDS instance
+    const repos = []
+    for (const did of dids) {
       const id = env.PDS.idFromName(did)
       const pds = env.PDS.get(id)
-      return pds.fetch(new Request(request.url, {
-        method: 'POST',
-        headers: request.headers,
-        body: JSON.stringify(body)
-      }))
+      const infoRes = await pds.fetch(new Request('http://internal/repo-info'))
+      const info = await infoRes.json()
+      if (info.head) {
+        repos.push({ did, head: info.head, rev: info.rev, active: true })
+      }
     }
+    return Response.json({ repos, cursor: undefined })
+  }
 
+  const did = url.searchParams.get('did')
+  if (!did) {
+    return new Response('missing did param', { status: 400 })
+  }
+
+  // On init, also register this DID with the default instance
+  if (url.pathname === '/init' && request.method === 'POST') {
+    const body = await request.json()
+
+    // Register with default instance for discovery
+    const defaultId = env.PDS.idFromName('default')
+    const defaultPds = env.PDS.get(defaultId)
+    await defaultPds.fetch(new Request('http://internal/register-did', {
+      method: 'POST',
+      body: JSON.stringify({ did })
+    }))
+
+    // Forward to the actual PDS instance
     const id = env.PDS.idFromName(did)
     const pds = env.PDS.get(id)
-    return pds.fetch(request)
+    return pds.fetch(new Request(request.url, {
+      method: 'POST',
+      headers: request.headers,
+      body: JSON.stringify(body)
+    }))
   }
+
+  const id = env.PDS.idFromName(did)
+  const pds = env.PDS.get(id)
+  return pds.fetch(request)
 }