Function options_allow 

pub async fn options_allow(
    __arg0: State<Arc<AppState>>,
    request: Request,
    next: Next,
) -> Response

Answer an OPTIONS with the methods its resource actually has.

This runs outside the CORS layer because that layer answers every OPTIONS itself and never calls what it wraps – if parts.method == Method::OPTIONS returns immediately, preflight or not. So an OPTIONS never reached the request handler at all: the body was empty because nothing built one, and Allow was missing because the code that knows the answer was never asked.

The CORS layer still writes the response, and this adds to it, so a preflight keeps every header it had.