srs-api: allowlist both docs origins for /api/stats CORS

api/src/index.ts

@@ -261,8 +261,13 @@ export default {
       }
 
       if (path === "/api/stats") {
+        // The docs serve from both the Pages origin and the custom domain;
+        // reflect the requesting origin only when it is on the allowlist.
+        const allowed = env.DOCS_ORIGIN.split(",").map((o) => o.trim());
+        const origin = request.headers.get("origin");
         const cors = {
-          "access-control-allow-origin": env.DOCS_ORIGIN,
+          "access-control-allow-origin":
+            origin && allowed.includes(origin) ? origin : allowed[0]!,
           "access-control-allow-methods": "GET",
           vary: "Origin",
         };

api/wrangler.jsonc

@@ -32,9 +32,8 @@
     "REPO": "prdlk/leetcode",
     "FROM_EMAIL": "srs@prdlk.com",
     "TO_EMAIL": "prnk28@gmail.com",
-    "DOCS_ORIGIN": "https://prdlk.github.io",
     "DOCS_URL": "https://prdlk.github.io/leetcode",
-    // Filled in after first deploy; used for one-tap links in the digest.
+    "DOCS_ORIGIN": "https://prdlk.github.io,https://lc.prad.nu",
     "PUBLIC_URL": "https://srs-api.prdlk.workers.dev"
   }