Add CORS support for landing download tracking endpoint.

Browsers on ttrpgplayer.ru need preflight and Access-Control-Allow-Origin on POST /v1/track/download.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/adminApi.test.mjs

@@ -19,10 +19,12 @@ function listen(server) {
   });
 }
 
-function request(port, method, pathname, { token, body } = {}) {
+function request(port, method, pathname, { token, body, origin } = {}) {
   return new Promise((resolve, reject) => {
-    const headers = { 'Content-Type': 'application/json' };
+    const headers = {};
+    if (body) headers['Content-Type'] = 'application/json';
     if (token) headers.Authorization = `Bearer ${token}`;
+    if (origin) headers.Origin = origin;
     const req = http.request(
       { hostname: '127.0.0.1', port, method, path: pathname, headers },
       (res) => {
@@ -30,7 +32,11 @@ function request(port, method, pathname, { token, body } = {}) {
         res.on('data', (c) => chunks.push(c));
         res.on('end', () => {
           const raw = Buffer.concat(chunks).toString('utf8');
-          resolve({ status: res.statusCode, body: raw ? JSON.parse(raw) : null });
+          resolve({
+            status: res.statusCode,
+            headers: res.headers,
+            body: raw ? JSON.parse(raw) : null,
+          });
         });
       },
     );
@@ -320,6 +326,66 @@ void test('POST /v1/track/download and GET stats', async () => {
   }
 });
 
+void test('OPTIONS /v1/track/download returns CORS preflight for allowed origin', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
+
+  const { server } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const res = await request(port, 'OPTIONS', '/v1/track/download', {
+      origin: 'https://ttrpgplayer.ru',
+    });
+    assert.equal(res.status, 204);
+    assert.equal(res.headers['access-control-allow-origin'], 'https://ttrpgplayer.ru');
+    assert.match(res.headers['access-control-allow-methods'], /POST/);
+    assert.equal(res.headers['access-control-allow-headers'], 'Content-Type');
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+void test('POST /v1/track/download includes CORS headers for allowed origin', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
+
+  const { server } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const res = await request(port, 'POST', '/v1/track/download', {
+      body: { platform: 'linux' },
+      origin: 'https://ttrpgplayer.ru',
+    });
+    assert.equal(res.status, 200);
+    assert.equal(res.headers['access-control-allow-origin'], 'https://ttrpgplayer.ru');
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+void test('OPTIONS /v1/track/download rejects unknown origin', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
+
+  const { server } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const res = await request(port, 'OPTIONS', '/v1/track/download', {
+      origin: 'https://evil.example',
+    });
+    assert.equal(res.status, 404);
+    assert.equal(res.body.error, 'not_found');
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
 void test('admin endpoints reject missing token', async () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
   const dataPath = path.join(tmp, 'data.json');