feat: add CORS support for server and worker

.gitignore

···
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 .idea/
 .vscode/
+dist/

Cargo.lock

···
 
 [[package]]
 name = "axum"
-version = "0.7.9"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
+checksum = "5b098575ebe77cb6d14fc7f32749631a6e44edbef6b796f89b020e99ba20d425"
 dependencies = [
- "async-trait",
  "axum-core",
  "bytes",
+ "form_urlencoded",
  "futures-util",
  "http",
  "http-body",
···
  "hyper",
  "hyper-util",
  "itoa",
- "matchit",
+ "matchit 0.8.4",
  "memchr",
  "mime",
  "percent-encoding",
  "pin-project-lite",
- "rustversion",
- "serde",
+ "serde_core",
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
···
 
 [[package]]
 name = "axum-core"
-version = "0.4.5"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
+checksum = "59446ce19cd142f8833f856eb31f3eb097812d1479ab224f54d72428ca21ea22"
 dependencies = [
- "async-trait",
  "bytes",
- "futures-util",
+ "futures-core",
  "http",
  "http-body",
  "http-body-util",
  "mime",
  "pin-project-lite",
- "rustversion",
  "sync_wrapper",
  "tower-layer",
  "tower-service",
···
 checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
 
 [[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
+[[package]]
 name = "mediatype"
 version = "0.19.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "serde_json",
  "tempfile",
  "tokio",
+ "tower",
+ "tower-http",
 ]
 
 [[package]]
···
  "http",
  "http-body",
  "js-sys",
- "matchit",
+ "matchit 0.7.3",
  "pin-project",
  "serde",
  "serde-wasm-bindgen",

DEPLOYMENT.md

···
    ./target/release/pai serve -d /var/lib/pai/pai.db -a 127.0.0.1:8080
    ```
 
+### CORS Configuration for Self-Hosted Server
+
+The HTTP server supports CORS configuration via `config.toml`. Add a `[cors]` section:
+
+```toml
+[cors]
+# List of allowed origins for cross-origin requests
+allowed_origins = ["https://desertthunder.dev", "http://localhost:4321"]
+
+# Optional development key for local testing
+dev_key = "your-secret-dev-key"
+```
+
+CORS features:
+
+- **Exact matching**: `http://localhost:4321` only allows that specific origin
+- **Same-root-domain**: `https://desertthunder.dev` also allows `https://pai.desertthunder.dev`, `https://api.desertthunder.dev`, etc.
+- **Dev key**: Requests with `X-Local-Dev-Key` header matching the configured key bypass origin checks
+
+The PAI server handles CORS automatically - no additional proxy configuration needed. See [README.md](./README.md#cors-configuration) for details.
+
 ## nginx Deployment
 
 ### Host Setup
···
 
 # BearBlog publications (comma-separated id:url pairs)
 BEARBLOG_URLS = "desertthunder:https://desertthunder.bearblog.dev"
+
+# CORS configuration (optional)
+CORS_ALLOWED_ORIGINS = "https://desertthunder.dev,http://localhost:4321"
+CORS_DEV_KEY = "your-secret-dev-key"
 ```
+
+### CORS Configuration
+
+The Worker supports CORS to allow cross-origin requests from your web applications.
+
+#### Environment Variables
+
+Add to `wrangler.toml` under `[vars]`:
+
+- **CORS_ALLOWED_ORIGINS**: Comma-separated list of allowed origins
+    - Supports exact matching: `http://localhost:4321` only allows that exact origin
+    - Supports same-root-domain: `https://desertthunder.dev` also allows `https://pai.desertthunder.dev`, `https://api.desertthunder.dev`, etc.
+
+- **CORS_DEV_KEY**: Optional development key for local testing
+    - When set, requests with the `X-Local-Dev-Key` header matching this value bypass origin checking
+    - Useful for testing from different local ports during development
+
+#### Example Configuration
+
+```toml
+[vars]
+# Allow requests from your main domain and localhost for development
+CORS_ALLOWED_ORIGINS = "https://desertthunder.dev,http://localhost:4321"
+
+# Dev key for local Astro development
+CORS_DEV_KEY = "local-dev-secret-123"
+```
+
+#### Usage from JavaScript
+
+```javascript
+// Production request from https://desertthunder.dev
+fetch('https://pai.desertthunder.dev/api/feed', {
+  credentials: 'include'
+})
+
+// Development request from http://localhost:4321
+fetch('http://localhost:8787/api/feed', {
+  headers: {
+    'X-Local-Dev-Key': 'local-dev-secret-123'
+  }
+})
+```
+
+#### Same-Root-Domain Support
+
+When you configure `CORS_ALLOWED_ORIGINS = "https://desertthunder.dev"`:
+
+- ✓ `https://desertthunder.dev` (exact match)
+- ✓ `https://pai.desertthunder.dev` (subdomain)
+- ✓ `https://api.desertthunder.dev` (subdomain)
+- ✗ `https://evil.dev` (different root domain)
+
+This allows you to deploy the Worker to `pai.desertthunder.dev` and access it from your main site at `desertthunder.dev` without explicitly listing every subdomain.
 
 ### API Endpoints
 

README.md

···
 
 See [config.example.toml](./config.example.toml) for a complete example with all available options.
 
+<details>
+<summary>
+CORS Configuration
+</summary>
+
+Both the HTTP server and Cloudflare Worker support CORS configuration to allow cross-origin requests from your web applications.
+
+### HTTP Server (config.toml)
+
+  Add a `[cors]` section to your config file:
+
+  ```toml
+  [cors]
+  allowed_origins = ["https://desertthunder.dev", "http://localhost:4321"]
+  dev_key = "your-secret-dev-key"
+  ```
+
+  Configuration options:
+
+- **allowed_origins**: List of allowed origins. Supports:
+    - Exact match: `http://localhost:4321` only allows that exact origin
+    - Same-root-domain: `https://desertthunder.dev` also allows `https://pai.desertthunder.dev`, `https://api.desertthunder.dev`, etc.
+- **dev_key**: Optional development key for local testing.
+    When set, requests with the `X-Local-Dev-Key` header matching this value are allowed regardless of origin.
+
+### Cloudflare Worker (Environment Variables)
+
+  Configure CORS via environment variables in `wrangler.toml`:
+
+  ```toml
+  [vars]
+  CORS_ALLOWED_ORIGINS = "https://desertthunder.dev,http://localhost:4321"
+  CORS_DEV_KEY = "your-secret-dev-key"
+  ```
+
+- **CORS_ALLOWED_ORIGINS**: Comma-separated list of allowed origins
+- **CORS_DEV_KEY**: Optional development key (same behavior as HTTP server)
+
+#### Local Development with X-LOCAL-DEV-KEY
+
+For local development from Astro or other frameworks:
+
+1. Add a `dev_key` to your CORS config:
+
+    ```toml
+    [cors]
+    allowed_origins = ["http://localhost:4321"]
+    dev_key = "local-dev-secret-123"
+    ```
+
+2. Include the header in your API requests:
+
+    ```javascript
+    fetch('http://localhost:8080/api/feed', {
+      headers: {
+        'X-Local-Dev-Key': 'local-dev-secret-123'
+      }
+    })
+    ```
+
+  The dev key header bypasses origin checking, useful for testing from different local ports or during development.
+
+#### Same-Root-Domain Support
+
+  If you configure `allowed_origins = ["https://desertthunder.dev"]`, requests from:
+
+- `https://desertthunder.dev` ✓ (exact match)
+- `https://pai.desertthunder.dev` ✓ (subdomain of allowed root)
+- `https://api.desertthunder.dev` ✓ (subdomain of allowed root)
+- `https://evil.dev` ✗ (different root domain)
+
+  This allows you to deploy the API at `pai.desertthunder.dev` and access it from your main site at `desertthunder.dev` without explicitly listing every subdomain.
+
+</details>
+
 ## Documentation
 
 - CLI synopsis: `pai -h`, `pai <command> -h`, or `pai man` for the generated `pai(1)` page.
-- `pai man --install [--install-dir DIR]` copies `pai.1` into a MANPATH directory (defaults to `~/.local/share/man/man1`) so `man pai` works like any other UNIX tool.
+- `pai man --install [--install-dir DIR]` copies `pai.1` into a MANPATH directory (defaults to `~/.local/share/man/man1`)
 - Database schema and config reference: [config.example.toml](./config.example.toml).
 - Deployment topologies: [DEPLOYMENT.md](./DEPLOYMENT.md).
 

cli/src/main.rs

···
 
 fn handle_serve(db_path: Option<PathBuf>, address: String) -> Result<(), PaiError> {
     let db_path = paths::resolve_db_path(db_path)?;
-    pai_server::serve(db_path, &address)
+    let config_path = paths::resolve_config_dir(None)?.join("config.toml");
+    let config = if config_path.exists() { Config::from_file(&config_path)? } else { Config::default() };
+    pai_server::serve(config, db_path, &address)
 }
 
 fn handle_db_check(db_path: Option<PathBuf>) -> Result<(), PaiError> {

config.example.toml

···
 d1_binding = "DB"
 database_name = "personal_activity_db"
 
+# CORS configuration for HTTP server (optional)
+[cors]
+# List of allowed origins for cross-origin requests
+# Supports exact match and same-root-domain matching
+# Example: "https://desertthunder.dev" allows pai.desertthunder.dev, api.desertthunder.dev, etc.
+allowed_origins = ["https://desertthunder.dev", "http://localhost:4321"]
+
+# Optional development key for local testing
+# When set, requests with X-Local-Dev-Key header matching this value are allowed
+dev_key = "your-secret-dev-key-change-this"
+
 # Substack RSS feed source
 [sources.substack]
 enabled = true

core/src/lib.rs

···
     pub bearblog: Vec<BearBlogConfig>,
 }
 
+/// CORS configuration for the HTTP server and Worker
+///
+/// Supports same-root-domain CORS (e.g., pai.desertthunder.dev from desertthunder.dev)
+/// and local development with a dev key header.
+#[derive(Debug, Clone, Deserialize, Serialize, Default)]
+pub struct CorsConfig {
+    /// List of allowed origins (exact match or same-root-domain)
+    /// Example: ["https://desertthunder.dev", "http://localhost:4321"]
+    #[serde(default)]
+    pub allowed_origins: Vec<String>,
+
+    /// Optional development key for local development
+    /// When set, requests with X-LOCAL-DEV-KEY header matching this value are allowed
+    pub dev_key: Option<String>,
+}
+
+impl CorsConfig {
+    /// Check if an origin is allowed based on exact match or same-root-domain logic.
+    ///
+    /// Same-root-domain means extracting the root domain (last two parts) from both
+    /// the origin and allowed origins, and checking for a match.
+    ///
+    /// Examples:
+    /// - https://pai.desertthunder.dev is allowed if https://desertthunder.dev is in allowed_origins
+    /// - http://localhost:4321 requires exact match
+    pub fn is_origin_allowed(&self, origin: &str) -> bool {
+        if self.allowed_origins.is_empty() {
+            return false;
+        }
+
+        let origin_domain = extract_domain(origin);
+
+        for allowed in &self.allowed_origins {
+            if origin == allowed {
+                return true;
+            }
+
+            let allowed_domain = extract_domain(allowed);
+            if let (Some(origin_root), Some(allowed_root)) = (
+                extract_root_domain(&origin_domain),
+                extract_root_domain(&allowed_domain),
+            ) {
+                if origin_root == allowed_root {
+                    return true;
+                }
+            }
+        }
+
+        false
+    }
+
+    /// Validate if a dev key matches the configured dev key
+    pub fn is_dev_key_valid(&self, key: Option<&str>) -> bool {
+        match (&self.dev_key, key) {
+            (Some(config_key), Some(request_key)) => config_key == request_key,
+            _ => false,
+        }
+    }
+}
+
+/// Extract domain from URL (removes protocol and path)
+fn extract_domain(url: &str) -> String {
+    url.trim_start_matches("https://")
+        .trim_start_matches("http://")
+        .split('/')
+        .next()
+        .unwrap_or("")
+        .split(':')
+        .next()
+        .unwrap_or("")
+        .to_string()
+}
+
+/// Extract root domain (last two parts of domain)
+/// Example: "pai.desertthunder.dev" -> Some("desertthunder.dev")
+/// Example: "localhost" -> None (single part)
+fn extract_root_domain(domain: &str) -> Option<String> {
+    let parts: Vec<&str> = domain.split('.').collect();
+    if parts.len() >= 2 {
+        Some(format!("{}.{}", parts[parts.len() - 2], parts[parts.len() - 1]))
+    } else {
+        None
+    }
+}
+
 /// Configuration for all sources
 #[derive(Debug, Clone, Deserialize, Serialize, Default)]
 pub struct Config {
···
     pub deployment: DeploymentConfig,
     #[serde(default)]
     pub sources: SourcesConfig,
+    #[serde(default)]
+    pub cors: CorsConfig,
 }
 
 impl Config {
···
         let config = Config::from_str(toml).unwrap();
         let substack = config.sources.substack.as_ref().unwrap();
         assert!(!substack.enabled);
+    }
+
+    #[test]
+    fn cors_config_exact_match() {
+        let cors = CorsConfig {
+            allowed_origins: vec![
+                "https://desertthunder.dev".to_string(),
+                "http://localhost:4321".to_string(),
+            ],
+            dev_key: None,
+        };
+        assert!(cors.is_origin_allowed("https://desertthunder.dev"));
+        assert!(cors.is_origin_allowed("http://localhost:4321"));
+        assert!(!cors.is_origin_allowed("https://evil.com"));
+    }
+
+    #[test]
+    fn cors_config_same_root_domain() {
+        let cors = CorsConfig { allowed_origins: vec!["https://desertthunder.dev".to_string()], dev_key: None };
+        assert!(cors.is_origin_allowed("https://pai.desertthunder.dev"));
+        assert!(cors.is_origin_allowed("https://api.desertthunder.dev"));
+        assert!(cors.is_origin_allowed("https://desertthunder.dev"));
+        assert!(!cors.is_origin_allowed("https://evil.dev"));
+    }
+
+    #[test]
+    fn cors_config_localhost_requires_exact_match() {
+        let cors = CorsConfig { allowed_origins: vec!["http://localhost:4321".to_string()], dev_key: None };
+        assert!(cors.is_origin_allowed("http://localhost:4321"));
+        assert!(!cors.is_origin_allowed("http://localhost:3000"));
+    }
+
+    #[test]
+    fn cors_config_empty_origins_denies_all() {
+        let cors = CorsConfig { allowed_origins: vec![], dev_key: None };
+        assert!(!cors.is_origin_allowed("https://desertthunder.dev"));
+        assert!(!cors.is_origin_allowed("http://localhost:4321"));
+    }
+
+    #[test]
+    fn cors_config_dev_key_valid() {
+        let cors = CorsConfig { allowed_origins: vec![], dev_key: Some("secret-dev-key".to_string()) };
+        assert!(cors.is_dev_key_valid(Some("secret-dev-key")));
+        assert!(!cors.is_dev_key_valid(Some("wrong-key")));
+        assert!(!cors.is_dev_key_valid(None));
+    }
+
+    #[test]
+    fn cors_config_dev_key_none() {
+        let cors = CorsConfig { allowed_origins: vec![], dev_key: None };
+        assert!(!cors.is_dev_key_valid(Some("any-key")));
+        assert!(!cors.is_dev_key_valid(None));
+    }
+
+    #[test]
+    fn extract_domain_https() {
+        assert_eq!(
+            super::extract_domain("https://desertthunder.dev/path"),
+            "desertthunder.dev"
+        );
+        assert_eq!(
+            super::extract_domain("https://pai.desertthunder.dev"),
+            "pai.desertthunder.dev"
+        );
+    }
+
+    #[test]
+    fn extract_domain_http() {
+        assert_eq!(super::extract_domain("http://localhost:4321/api"), "localhost");
+        assert_eq!(super::extract_domain("http://example.com"), "example.com");
+    }
+
+    #[test]
+    fn extract_root_domain_multi_level() {
+        assert_eq!(
+            super::extract_root_domain("pai.desertthunder.dev"),
+            Some("desertthunder.dev".to_string())
+        );
+        assert_eq!(
+            super::extract_root_domain("api.example.com"),
+            Some("example.com".to_string())
+        );
+        assert_eq!(
+            super::extract_root_domain("a.b.c.example.org"),
+            Some("example.org".to_string())
+        );
+    }
+
+    #[test]
+    fn extract_root_domain_single_part() {
+        assert_eq!(super::extract_root_domain("localhost"), None);
+    }
+
+    #[test]
+    fn extract_root_domain_two_parts() {
+        assert_eq!(
+            super::extract_root_domain("example.com"),
+            Some("example.com".to_string())
+        );
+    }
+
+    #[test]
+    fn config_parse_cors() {
+        let toml = r#"
+[cors]
+allowed_origins = ["https://desertthunder.dev", "http://localhost:4321"]
+dev_key = "my-dev-key"
+"#;
+        let config = Config::from_str(toml).unwrap();
+        assert_eq!(config.cors.allowed_origins.len(), 2);
+        assert_eq!(config.cors.allowed_origins[0], "https://desertthunder.dev");
+        assert_eq!(config.cors.dev_key, Some("my-dev-key".to_string()));
     }
 }

server/Cargo.toml

···
 
 [dependencies]
 pai-core = { path = "../core" }
-axum = "0.7"
+axum = "0.8"
 tokio = { version = "1.40", features = ["macros", "rt-multi-thread", "signal"] }
 rusqlite = { version = "0.37", features = ["bundled"] }
 serde = { version = "1.0", features = ["derive"] }
···
 owo-colors = "4.1"
 chrono = "0.4"
 rss = "2.0"
+tower = "0.5"
+tower-http = { version = "0.6", features = ["cors"] }
 
 [dev-dependencies]
 tempfile = "3.13"

server/src/server.rs

···
 use crate::storage::SqliteStorage;
 
 use axum::{
-    extract::{Path, Query, State},
-    http::{header, StatusCode},
+    extract::{Path, Query, Request, State},
+    http::{header, HeaderValue, Method, StatusCode},
+    middleware::{self, Next},
     response::{IntoResponse, Response},
     routing::get,
     Json, Router,
 };
 use chrono::DateTime;
 use owo_colors::OwoColorize;
-use pai_core::{Item, ListFilter, PaiError, SourceKind};
+use pai_core::{Config, CorsConfig, Item, ListFilter, PaiError, SourceKind};
 use rss::{Channel, ChannelBuilder, ItemBuilder};
 use serde::{Deserialize, Serialize};
 use std::{io, net::SocketAddr, path::PathBuf, sync::Arc, time::Instant};
···
 const DEFAULT_LIMIT: usize = 20;
 const VERSION: &str = env!("CARGO_PKG_VERSION");
 
-/// Launches the HTTP server using the provided SQLite database path and address.
-pub fn serve(db_path: PathBuf, address: &str) -> Result<(), PaiError> {
+/// Launches the HTTP server using the provided config and address.
+pub fn serve(config: Config, db_path: PathBuf, address: &str) -> Result<(), PaiError> {
     let addr: SocketAddr = address
         .parse()
         .map_err(|e| PaiError::Config(format!("Invalid listen address '{address}': {e}")))?;
···
         .build()
         .map_err(PaiError::Io)?;
 
-    runtime.block_on(async move { run_server(db_path, addr).await })
+    runtime.block_on(async move { run_server(config, db_path, addr).await })
 }
 
-async fn run_server(db_path: PathBuf, addr: SocketAddr) -> Result<(), PaiError> {
+async fn run_server(config: Config, db_path: PathBuf, addr: SocketAddr) -> Result<(), PaiError> {
     let storage = SqliteStorage::new(&db_path)?;
     storage.verify_schema()?;
     drop(storage);
 
-    let state = AppState { db_path: Arc::new(db_path), start_time: Instant::now() };
+    let state =
+        AppState { db_path: Arc::new(db_path), start_time: Instant::now(), cors_config: Arc::new(config.cors.clone()) };
 
-    let app = Router::new()
+    let mut app = Router::new()
         .route("/api/feed", get(feed_handler))
         .route("/api/item/:id", get(item_handler))
         .route("/status", get(status_handler))
         .route("/rss.xml", get(rss_handler))
-        .with_state(state);
+        .with_state(state.clone());
+
+    if !config.cors.allowed_origins.is_empty() || config.cors.dev_key.is_some() {
+        app = app.layer(middleware::from_fn_with_state(state.clone(), cors_middleware));
+    }
 
     let listener = TcpListener::bind(addr).await.map_err(PaiError::Io)?;
     let local_addr = listener.local_addr().map_err(PaiError::Io)?;
···
         .map_err(|e| io::Error::other(e).into())
 }
 
+/// CORS middleware that validates origins and dev keys
+async fn cors_middleware(State(state): State<AppState>, request: Request, next: Next) -> Result<Response, StatusCode> {
+    let origin = request
+        .headers()
+        .get(header::ORIGIN)
+        .and_then(|v| v.to_str().ok())
+        .map(|s| s.to_string());
+    let dev_key = request
+        .headers()
+        .get("x-local-dev-key")
+        .and_then(|v| v.to_str().ok())
+        .map(|s| s.to_string());
+    let method = request.method().clone();
+
+    let is_authorized = if let Some(ref key) = dev_key {
+        state.cors_config.is_dev_key_valid(Some(key))
+    } else if let Some(ref origin_str) = origin {
+        state.cors_config.is_origin_allowed(origin_str)
+    } else {
+        true
+    };
+
+    if method == Method::OPTIONS {
+        if !is_authorized {
+            return Err(StatusCode::FORBIDDEN);
+        }
+
+        let mut response = Response::new(String::new().into());
+        if let Some(ref origin_str) = origin {
+            response.headers_mut().insert(
+                header::ACCESS_CONTROL_ALLOW_ORIGIN,
+                HeaderValue::from_str(origin_str).unwrap_or(HeaderValue::from_static("*")),
+            );
+        }
+        response.headers_mut().insert(
+            header::ACCESS_CONTROL_ALLOW_METHODS,
+            HeaderValue::from_static("GET, POST, OPTIONS"),
+        );
+        response.headers_mut().insert(
+            header::ACCESS_CONTROL_ALLOW_HEADERS,
+            HeaderValue::from_static("Content-Type, X-Local-Dev-Key"),
+        );
+        response
+            .headers_mut()
+            .insert(header::ACCESS_CONTROL_MAX_AGE, HeaderValue::from_static("3600"));
+        return Ok(response);
+    }
+
+    if origin.is_some() && !is_authorized {
+        return Err(StatusCode::FORBIDDEN);
+    }
+
+    let mut response = next.run(request).await;
+
+    if let Some(ref origin_str) = origin {
+        if is_authorized {
+            response.headers_mut().insert(
+                header::ACCESS_CONTROL_ALLOW_ORIGIN,
+                HeaderValue::from_str(origin_str).unwrap_or(HeaderValue::from_static("*")),
+            );
+            response.headers_mut().insert(
+                header::ACCESS_CONTROL_ALLOW_CREDENTIALS,
+                HeaderValue::from_static("true"),
+            );
+        }
+    }
+
+    Ok(response)
+}
+
 #[derive(Clone)]
 struct AppState {
     db_path: Arc<PathBuf>,
     start_time: Instant,
+    cors_config: Arc<CorsConfig>,
 }
 
 impl AppState {
···
     fn status_snapshot_reports_counts() {
         let dir = tempdir().unwrap();
         let db_path = dir.path().join("status.db");
-        let state = AppState { db_path: Arc::new(db_path), start_time: Instant::now() };
+        let state = AppState {
+            db_path: Arc::new(db_path),
+            start_time: Instant::now(),
+            cors_config: Arc::new(pai_core::CorsConfig::default()),
+        };
 
         let storage = state.open_storage().unwrap();
         let now = Utc::now().to_rfc3339();

worker/src/lib.rs

···
-use pai_core::{Item, ListFilter, SourceKind};
+use pai_core::{CorsConfig, Item, ListFilter, SourceKind};
 use serde::{Deserialize, Serialize};
 use wasm_bindgen::JsValue;
 use worker::*;
···
 
 #[event(fetch)]
 async fn fetch(req: Request, env: Env, _ctx: Context) -> Result<Response> {
+    let cors_config = load_cors_config(&env);
+
+    if req.method() == Method::Options {
+        return handle_preflight(&req, &cors_config);
+    }
+
+    if !is_cors_authorized(&req, &cors_config) {
+        return Response::error("Forbidden", 403);
+    }
+
+    let origin = req.headers().get("Origin").ok().flatten();
+
     let router = Router::new();
-    router
+    let mut response = router
         .get_async("/", |req, _ctx| async move {
             let url = req
                 .url()
···
             Response::from_json(&status)
         })
         .run(req, env)
-        .await
+        .await?;
+
+    if let Some(origin_str) = origin {
+        response.headers_mut().set("Access-Control-Allow-Origin", &origin_str)?;
+        response.headers_mut().set("Access-Control-Allow-Credentials", "true")?;
+    }
+
+    Ok(response)
 }
 
 #[event(scheduled)]
···
     };
 
     Ok(SyncConfig { substack, bluesky, leaflet, bearblog })
+}
+
+/// Load CORS configuration from environment variables
+fn load_cors_config(env: &Env) -> CorsConfig {
+    let allowed_origins = env
+        .var("CORS_ALLOWED_ORIGINS")
+        .ok()
+        .map(|origins| origins.to_string().split(',').map(|s| s.trim().to_string()).collect())
+        .unwrap_or_default();
+
+    let dev_key = env.var("CORS_DEV_KEY").ok().map(|k| k.to_string());
+
+    CorsConfig { allowed_origins, dev_key }
+}
+
+/// Check if request is authorized for CORS
+fn is_cors_authorized(req: &Request, cors_config: &CorsConfig) -> bool {
+    if let Ok(Some(key)) = req.headers().get("X-Local-Dev-Key") {
+        if cors_config.is_dev_key_valid(Some(&key)) {
+            return true;
+        }
+    }
+
+    if let Ok(Some(origin_str)) = req.headers().get("Origin") {
+        return cors_config.is_origin_allowed(&origin_str);
+    }
+
+    true
+}
+
+/// Handle preflight OPTIONS requests
+fn handle_preflight(req: &Request, cors_config: &CorsConfig) -> Result<Response> {
+    if !is_cors_authorized(req, cors_config) {
+        return Response::error("Forbidden", 403);
+    }
+
+    let mut response = Response::empty()?;
+    let response_headers = response.headers_mut();
+
+    if let Ok(Some(origin)) = req.headers().get("Origin") {
+        response_headers.set("Access-Control-Allow-Origin", &origin)?;
+    }
+
+    response_headers.set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")?;
+    response_headers.set("Access-Control-Allow-Headers", "Content-Type, X-Local-Dev-Key")?;
+    response_headers.set("Access-Control-Max-Age", "3600")?;
+
+    Ok(response)
 }
 
 async fn sync_substack(config: &SubstackConfig, db: &D1Database) -> Result<usize> {

worker/wrangler.example.toml

···
 # Format: "id1:https://blog1.bearblog.dev,id2:https://blog2.bearblog.dev"
 BEARBLOG_URLS = "desertthunder:https://desertthunder.bearblog.dev"
 
+# CORS configuration (optional)
+# Comma-separated list of allowed origins for cross-origin requests
+# Supports exact match and same-root-domain matching
+# Example: "https://desertthunder.dev" allows pai.desertthunder.dev, api.desertthunder.dev, etc.
+CORS_ALLOWED_ORIGINS = "https://desertthunder.dev,http://localhost:4321"
+
+# Optional development key for local testing
+# When set, requests with X-Local-Dev-Key header matching this value are allowed
+CORS_DEV_KEY = "your-secret-dev-key-change-this"
+
 # Optional: Logging level
 # LOG_LEVEL = "info"