fix(extension): CORS preflight for moz-extension:// + chrome-extension:// origins — operator-flagged 2026-05-26 that the extension's Test connection returned NetworkError because /api/credentials POSTs with X-Extension-Key trigger a browser preflight OPTIONS that hit a 405 (no OPTIONS method registered) with no Access-Control-Allow-* headers. Adds two app-level hooks: before_request short-circuits OPTIONS from extension origins with 204, after_request stamps the necessary ACL headers on responses to extension-origin requests. Whitelist is intentionally narrow (extension schemes only) so normal browser usage doesn't get permissive CORS. Five integration tests pin the contract.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/__init__.py

@@ -3,13 +3,23 @@
 import logging
 from pathlib import Path
 
-from quart import Quart
+from quart import Quart, request
 
 from .api import all_blueprints
 from .config import get_config
 from .frontend import frontend_bp
 from .services.credential_crypto import CredentialCrypto
 
+# Browser-extension origins. The FabledCurator extension fetches from
+# moz-extension://<uuid>/ on Firefox and chrome-extension://<uuid>/ on
+# Chromium-based browsers. Operator-flagged 2026-05-26: extension's
+# 'Test connection' returned `NetworkError` because the X-Extension-Key
+# header on /api/credentials triggers a CORS preflight that our routes
+# don't handle. Whitelisting only these two schemes (not opening CORS
+# up generally) lets the extension talk to a plain-HTTP self-hosted FC
+# without weakening the no-CORS posture for normal browser usage.
+_EXTENSION_ORIGIN_SCHEMES = ("moz-extension://", "chrome-extension://")
+
 _CREDENTIAL_KEY_PATH = Path("/images/secrets/credential_key.b64")
 
 
@@ -35,6 +45,33 @@ def create_app() -> Quart:
     # Registered last so /api/* routes win over the SPA catch-all.
     app.register_blueprint(frontend_bp)
 
+    @app.before_request
+    async def _extension_cors_preflight():
+        # Short-circuit OPTIONS preflight from the browser extension with a
+        # 204 + CORS headers (the after_request hook below adds them).
+        # Without this, OPTIONS lands on routes that only declared POST/GET
+        # methods and 405s before the after_request gets a chance.
+        if request.method != "OPTIONS":
+            return None
+        origin = request.headers.get("Origin", "")
+        if any(origin.startswith(s) for s in _EXTENSION_ORIGIN_SCHEMES):
+            return "", 204
+        return None
+
+    @app.after_request
+    async def _extension_cors_headers(response):
+        origin = request.headers.get("Origin", "")
+        if any(origin.startswith(s) for s in _EXTENSION_ORIGIN_SCHEMES):
+            response.headers["Access-Control-Allow-Origin"] = origin
+            response.headers["Access-Control-Allow-Methods"] = (
+                "GET, POST, PATCH, DELETE, OPTIONS"
+            )
+            response.headers["Access-Control-Allow-Headers"] = (
+                "Content-Type, X-Extension-Key"
+            )
+            response.headers["Access-Control-Max-Age"] = "86400"
+        return response
+
     @app.after_serving
     async def _dispose_db_engine() -> None:
         from .extensions import dispose_engine