From 8978dacaa91418ce1d1ffefcd17a6d6b9e3d5d56 Mon Sep 17 00:00:00 2001
From: Derek <256792747+decofe@users.noreply.github.com>
Date: Mon, 29 Jun 2026 11:00:49 +0000
Subject: [PATCH] Fix docs faucet CORS origin

---
 src/lib/faucet-api.test.ts   | 8 ++++++--
 src/pages/_api/api/faucet.ts | 4 ++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/lib/faucet-api.test.ts b/src/lib/faucet-api.test.ts
index 07a777a1..b8a93f7b 100644
--- a/src/lib/faucet-api.test.ts
+++ b/src/lib/faucet-api.test.ts
@@ -70,10 +70,12 @@ describe('faucet API', () => {
   })
 
   it('allows docs and Vercel origins for CORS', async () => {
-    const docsResponse = await OPTIONS(requestWithOrigin('https://tempo.xyz'))
+    const tempoResponse = await OPTIONS(requestWithOrigin('https://tempo.xyz'))
+    const docsResponse = await OPTIONS(requestWithOrigin('https://docs.tempo.xyz'))
     const vercelResponse = await OPTIONS(requestWithOrigin('https://docs-git-branch.vercel.app'))
 
-    expect(docsResponse.headers.get('Access-Control-Allow-Origin')).toBe('https://tempo.xyz')
+    expect(tempoResponse.headers.get('Access-Control-Allow-Origin')).toBe('https://tempo.xyz')
+    expect(docsResponse.headers.get('Access-Control-Allow-Origin')).toBe('https://docs.tempo.xyz')
     expect(vercelResponse.headers.get('Access-Control-Allow-Origin')).toBe(
       'https://docs-git-branch.vercel.app',
     )
@@ -81,8 +83,10 @@ describe('faucet API', () => {
 
   it('does not allow arbitrary CORS origins', async () => {
     const response = await OPTIONS(requestWithOrigin('https://example.com'))
+    const prefixResponse = await OPTIONS(requestWithOrigin('https://tempo.xyz.example.com'))
 
     expect(response.headers.get('Access-Control-Allow-Origin')).toBeNull()
+    expect(prefixResponse.headers.get('Access-Control-Allow-Origin')).toBeNull()
   })
 })
 
diff --git a/src/pages/_api/api/faucet.ts b/src/pages/_api/api/faucet.ts
index 627cbdf8..f1aaaaa4 100644
--- a/src/pages/_api/api/faucet.ts
+++ b/src/pages/_api/api/faucet.ts
@@ -54,7 +54,7 @@ async function fund(address: `0x${string}`, headers: Record<string, string>): Pr
 }
 
 function cors(origin: string | null): Record<string, string> {
-  const allowedOrigins = ['https://tempo.xyz']
+  const allowedOrigins = ['https://tempo.xyz', 'https://docs.tempo.xyz']
 
   if (origin?.includes('vercel.app')) allowedOrigins.push(origin)
   if (process.env.NODE_ENV === 'development') allowedOrigins.push('http://localhost:5173')
@@ -64,7 +64,7 @@ function cors(origin: string | null): Record<string, string> {
     'Access-Control-Allow-Headers': 'Content-Type, x-api-token',
   }
 
-  if (origin && allowedOrigins.some((allowed) => origin.startsWith(allowed)))
+  if (origin && allowedOrigins.includes(origin))
     headers['Access-Control-Allow-Origin'] = origin
 
   return headers