API : @fastify/cors 11.3.0, méthodes annoncées gardées

Reprend la PR Dependabot #32. Rupture de la 11.0.0 : la pré-vérification CORS n'annonce plus par défaut que GET, HEAD et POST, un navigateur d'une autre origine aurait refusé les PUT, PATCH et DELETE de l'API. La liste d'avant est maintenant écrite dans app.ts, et un test vérifie la réponse à un OPTIONS d'une origine autorisée (il échoue sans la ligne). Option origin inchangée. Les ajouts de la 11.x (logLevel du préflight, cors par route dans config.cors) ne sont pas utilisés. 113 tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/package-lock.json

@@ -8,7 +8,7 @@
       "name": "backend",
       "version": "0.1.0",
       "dependencies": {
-        "@fastify/cors": "^10.1.0",
+        "@fastify/cors": "^11.3.0",
         "@fastify/jwt": "^10.2.2",
         "@fastify/rate-limit": "^11.2.0",
         "@prisma/client": "^6.15.0",
@@ -498,7 +498,9 @@
       }
     },
     "node_modules/@fastify/cors": {
-      "version": "10.1.0",
+      "version": "11.3.0",
+      "resolved": "https://registry.npmjs.org/@fastify/cors/-/cors-11.3.0.tgz",
+      "integrity": "sha512-ggQGua+xHv1MvePbPr0v//xLYEsCXbWspquXCJS9Ot5YoRXq8J8ZWzHnxDBVnbtXosvistXo6LtNzOJswf64Fw==",
       "funding": [
         {
           "type": "github",
@@ -511,8 +513,8 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "fastify-plugin": "^5.0.0",
-        "mnemonist": "0.40.0"
+        "fastify-plugin": "^6.0.0",
+        "toad-cache": "^3.7.0"
       }
     },
     "node_modules/@fastify/error": {
@@ -583,22 +585,6 @@
         "steed": "^1.1.3"
       }
     },
-    "node_modules/@fastify/jwt/node_modules/fastify-plugin": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz",
-      "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/@fastify/merge-json-schemas": {
       "version": "0.2.1",
       "funding": [
@@ -656,22 +642,6 @@
         "toad-cache": "^3.7.0"
       }
     },
-    "node_modules/@fastify/rate-limit/node_modules/fastify-plugin": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz",
-      "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/@img/colour": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz",
@@ -2135,7 +2105,9 @@
       }
     },
     "node_modules/fastify-plugin": {
-      "version": "5.1.0",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz",
+      "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==",
       "funding": [
         {
           "type": "github",

backend/package.json

@@ -17,7 +17,7 @@
     "prisma:deploy": "prisma migrate deploy"
   },
   "dependencies": {
-    "@fastify/cors": "^10.1.0",
+    "@fastify/cors": "^11.3.0",
     "@fastify/jwt": "^10.2.2",
     "@fastify/rate-limit": "^11.2.0",
     "@prisma/client": "^6.15.0",

backend/src/app.ts

@@ -53,6 +53,8 @@ export function createApp() {
 
   app.register(cors, {
     origin: env.CORS_ORIGIN.length === 1 ? env.CORS_ORIGIN[0] : env.CORS_ORIGIN,
+    // @fastify/cors 11 n'annonce plus par défaut que GET, HEAD et POST : l'API sert aussi PUT, PATCH, DELETE
+    methods: 'GET,HEAD,PUT,PATCH,POST,DELETE',
   })
 
   app.register(rateLimit, {

backend/test/api-routes.test.ts

@@ -582,6 +582,23 @@ describe('Health check', () => {
   })
 })
 
+describe('CORS', () => {
+  it('annonce PUT, PATCH et DELETE dans la réponse de pré-vérification', async () => {
+    const app = createApp()
+
+    const response = await app.inject({
+      method: 'OPTIONS',
+      url: '/trees/tree-1',
+      headers: { origin: 'http://localhost:5173', 'access-control-request-method': 'DELETE' },
+    })
+
+    expect(response.statusCode).toBe(204)
+    expect(response.headers['access-control-allow-origin']).toBe('http://localhost:5173')
+    expect(response.headers['access-control-allow-methods']).toBe('GET,HEAD,PUT,PATCH,POST,DELETE')
+    await app.close()
+  })
+})
+
 describe('Tree CRUD', () => {
   it('creates a tree and returns it', async () => {
     const app = createApp()