From fddfcfd2a69112df090d025bc0e5c8b06495e5d7 Mon Sep 17 00:00:00 2001 From: David Montero Crespo Date: Tue, 26 May 2026 22:35:51 -0300 Subject: [PATCH] fix(cors): allow Tauri desktop origins so v0.4.0 agent fetches don't fail MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit User report after the v0.4.0 desktop agent landed: > agente devuelve "LLM call failed: Failed to fetch" "Failed to fetch" is a network-layer error, not 401. Root cause: the OSS CORS allow_origins list only included http://localhost:517[3-5] (vite dev) and settings.FRONTEND_URL. The desktop bundle runs from either tauri://localhost (macOS/Linux) or http://tauri.localhost (Windows) - both cross-origin to velxio.dev - so the browser blocked the agent's POST /api/pro/agent/llm preflight before the backend ever saw it. Added all three Tauri scheme variants to the allow list. After this lands + a backend restart the desktop agent's fetch reaches the real /api/pro/agent/llm and the dual-auth dep from v0.4.0 Phase 1 gets to do its job (Bearer license-key → resolved User → quota check → upstream LLM proxy). Origins added: tauri://localhost # macOS / Linux (Tauri 2.x default) http://tauri.localhost # Windows (Tauri 2.x default) https://tauri.localhost # older Tauri 2.x releases allow_credentials stays True - the existing cookies-from-web flow still works, the Tauri origins just don't have any cookies to send. Co-Authored-By: Claude Opus 4.7 (1M context) --- backend/app/main.py | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/backend/app/main.py b/backend/app/main.py index 57a3e3c2..464657de 100644 --- a/backend/app/main.py +++ b/backend/app/main.py @@ -62,13 +62,26 @@ app = FastAPI( openapi_url="/api/openapi.json", ) -# CORS for local development +# CORS — local Vite dev, the prod web origin, AND the Velxio Desktop +# Tauri origins. The desktop bundle runs from a non-http scheme so +# every fetch to velxio.dev is cross-origin and the browser blocks +# preflight unless we explicitly allow the Tauri scheme(s). +# +# Tauri origin per OS: +# - macOS / Linux: `tauri://localhost` +# - Windows: `http://tauri.localhost` +# - older Tauri: `https://tauri.localhost` +# All three are listed so the desktop bundle works regardless of +# host OS or Tauri version. app.add_middleware( CORSMiddleware, allow_origins=[ "http://localhost:5173", "http://localhost:5174", "http://localhost:5175", + "tauri://localhost", + "http://tauri.localhost", + "https://tauri.localhost", settings.FRONTEND_URL, ], allow_credentials=True,