Validation: pal-e-api #256 -- Add CORS Middleware

validation-256-2026-04-12 Doc

validation partial

Project

Validation: pal-e-api #256 -- Add CORS Middleware

Ticket

Forgejo issue: forgejo_admin/pal-e-api#256 -- Add CORS middleware
PR: #260 (merged to main)
Board item: #971 on board-pal-e-docs
What was shipped: CORS middleware for cross-origin frontend access to pal-e-api.

Environment

Production cluster, namespace pal-e-docs, Tailscale funnel URL https://pal-e-docs.tail5b443a.ts.net.

Checks

#	Criterion	How to Verify	Result	Evidence
1	Pod redeployed with merged code	<code>kubectl -n pal-e-docs get pods -o wide</code>	FAIL	Pod <code>pal-e-docs-76b5f66c69-qxlg6</code> is 14d old, image tag <code>89f663bb...</code>. No redeployment occurred.
2	Woodpecker pipeline green for merge commit	<code>list_pipelines</code> for pal-e-api main	FAIL	Pipeline #90 (push to main for PR #260) has status <code>failure</code>. Migration-test step fails with <code>ImportError: cannot import name 'Board' from 'pal_e_docs.models'</code> in <code>alembic/env.py</code>. This is an unrelated pre-existing import issue, not a CORS defect.
3	CORS headers present for allowed origin	<code>curl -D- -H "Origin: https://pal-e-production.tail5b443a.ts.net" https://pal-e-docs.tail5b443a.ts.net/notes/arch-westside-emails</code>	FAIL	Response headers show no <code>access-control-allow-origin</code>. Expected -- old image is still running.
4	Preflight returns 200/204 with allow-methods	<code>curl -X OPTIONS</code> with CORS preflight headers	FAIL	Returns <code>HTTP/2 405</code> with <code>allow: GET</code>. No CORS preflight handling -- old image.
5	Disallowed origin gets no CORS header	<code>curl -H "Origin: https://evil.example.com"</code>	N/A	Cannot verify -- CORS middleware not deployed yet. No headers present on any origin.

Verdict

PARTIAL -- Awaiting deployment. PR #260 is merged but Woodpecker pipeline #90 failed due to an unrelated Board import error in alembic/env.py. The pod has not been redeployed. Pipeline #92 appears to be a fix attempt for this import issue. CORS checks cannot pass until the image is rebuilt and deployed.

Blocker

Woodpecker pipeline #90 failure: ImportError: cannot import name 'Board' from 'pal_e_docs.models' in the migration-test step. This blocks image build and deployment for all pal-e-api merges, not just this ticket.

Discovered Issues

CI blocker: The alembic/env.py stale Board import is blocking all pal-e-api deployments. Pipeline #92 (PR for the fix) also shows status error. This needs immediate attention -- it is a cross-cutting blocker for all pal-e-api work.