tandem-server 0.7.1

HTTP server for Tandem engine APIs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

// Copyright (c) 2026 Frumu LTD
// Licensed under the Business Source License 1.1

#[tokio::test]
async fn public_automation_webhook_allows_configured_browser_preflight_headers() {
    let state = test_state().await;
    let response = app_router(state)
        .oneshot(
            Request::builder()
                .method("OPTIONS")
                .uri("/webhooks/automations/whpub_preflight")
                .header("origin", "http://localhost:3000")
                .header("access-control-request-method", "POST")
                .header(
                    "access-control-request-headers",
                    "content-type,x-tandem-webhook-secret,x-tandem-webhook-signature,x-tandem-webhook-event-id",
                )
                .body(Body::empty())
                .expect("preflight request"),
        )
        .await
        .expect("preflight response");

    assert_eq!(response.status(), StatusCode::OK);
    assert_eq!(
        response
            .headers()
            .get("access-control-allow-origin")
            .and_then(|value| value.to_str().ok()),
        Some("http://localhost:3000")
    );
    let allowed_headers = response
        .headers()
        .get("access-control-allow-headers")
        .and_then(|value| value.to_str().ok())
        .unwrap_or_default()
        .to_ascii_lowercase();
    for expected in [
        "content-type",
        "x-tandem-webhook-secret",
        "x-tandem-webhook-signature",
        "x-tandem-webhook-event-id",
    ] {
        assert!(
            allowed_headers
                .split(",")
                .any(|value| value.trim() == expected),
            "missing allowed preflight header {expected}: {allowed_headers}"
        );
    }
}