Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Backend & Infrastructure›Backend API·33 in this wave

Approve: Backend APITo do · blocker Implement /api/profile or remove routeDone Implement /api/uploadDone Implement destination analyticsDone Add upload size limits and file validationDone Define the API versioning strategyDone Verify all 14 destination content read endpointsDone Verify the five existing destination update endpoints workIn progress Fix the stale SENTRY_RELEASE on tactile-apiDone iOS decodes payment_destinations as an array — a latent whole-list decode failureTo do Add staging.tactile.to to the API CORS allowlistDone Emit CardSchema (not bare ActionPreview) from the 12 non-QR tool preview generatorsDone pnpm verify is red on main, and CI hides 9 more failures by excluding three test filesDone EMIT LEG: send method:\"link\" from the clients, or the Link bucket stays at zeroTo do POST /api/events/open is documented public+unauth but 401s anonymouslyDone Staging has no RATE_LIMIT_DO binding — both rate limiters fail open thereDone Mask the Wi-Fi password before it reaches agent proposal cards (blocks WifiCard)Done link_hub.ts has the identical partial-drop hole contact.ts just hadDone Add /health endpointDone Replace link-click placeholder zeroDone Verify documents/gallery/audio routes completeDone Add structured logging via pino-compatible APIIn progress Add request-id middlewareDone Add Sentry to WorkersDone Verify the four completed Backend API items in productionIn progress Build update endpoint for menu destinationsDone Build update endpoint for link_hub destinationsDone Build update endpoint for payment destinationsDone Build update endpoint for wifi destinationsDone Build update endpoint for bluetooth destinationsDone Build update endpoint for action destinationsDone Build the webhook MCP module (tools/webhook.ts) — Matthew chose SHIP over cutDone Derive per-type opIds for destination.create/edit so Website + Gallery cards can renderDone

Wave

Backend API

The long pole — Auth, Billing, Email, Custom Domains and Edge Functions all wait on this gate.

TacTile › Launch TacTile › Backend & Infrastructure › Backend API

27/33 done6 open1 open blocker

Selected taskclear

Add staging.tactile.to to the API CORS allowlist

DoneOwner · ait_a615a44c

One-line allowlist addition in apps/api/tactile-api/src/utils/cors.ts. Blocks the web session from verifying form submission end-to-end on staging.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Add staging.tactile.to to the API CORS allowlist** · done

One-line allowlist addition in apps/api/tactile-api/src/utils/cors.ts. Blocks the web session from verifying form submission end-to-end on staging.

Where it sits: TacTile › Launch TacTile › Backend &amp; Infrastructure › Backend API

## The brief on file

BACKEND SESSION — you own apps/api/**. Handed over from the web session (t_cf4c4c8a, wave w_74f83765); the web session does not edit apps/api.

WHAT: `apps/api/tactile-api/src/utils/cors.ts` line 8-17 declares STATIC_ALLOWED_ORIGINS. It contains
  https://tactile.to, https://www.tactile.to, https://tactile-web.tactile.workers.dev,
  https://whitelabel.tactile.to, https://app.tactile-connect.com, https://staging-app.tactile-connect.com
It does NOT contain https://staging.tactile.to.

Add `"https://staging.tactile.to",` with a comment saying why. Suggested wording:
  // apps/web staging (worker `tactile-staging`, route staging.tactile.to/*). The
  // /t/[hash] form destination POSTs cross-origin from this apex to the API, so
  // without this entry handlePreflight returns 403 and no form on staging can submit.

WHY IT MATTERS: `handlePreflight` (cors.ts:51-60) returns a bare 403 for any origin not allowlisted. The public form viewer at apps/web/app/t/[hash]/route.ts renders a page whose client JS POSTs `Content-Type: application/json` to `${apiOrigin}/api/form/:hash/submit` — a preflighted cross-origin request. On staging that preflight is currently rejected, which is why "a submitted response is accepted and stored" (task t_33f654a2) was never verified against anything but `tsc --noEmit`.

NOTE the sibling entry `https://staging-app.tactile-connect.com` is already present for apps/web-mobile's staging apex. The omission of staging.tactile.to is an inconsistency, not a deliberate policy — but see the caveat below before assuming it is harmless.

CAVEAT WORTH READING BEFORE YOU MERGE: per the root CLAUDE.md there is no staging database — staging-api.tactile.to serves the SAME production Supabase project. So allowlisting the staging origin means a staging page can write rows into the production database. That is already true of every other staging entry in this list, and the API's own authz still applies, but it is a security-boundary fact rather than a pure plumbing fix. Matthew has been asked to confirm (decision D2 in docs/proposals/session-briefs/web-public-viewer.md). Do not ship this to production ahead of that answer.

RELATED WEB-SIDE CHANGE (already made on branch feature/web, do not duplicate): apps/web/wrangler.jsonc set `NEXT_PUBLIC_API_URL` for staging, but every apps/web viewer route reads `NEXT_PUBLIC_API_ORIGIN`. That mismatch meant the staging viewer silently called the PRODUCTION API. It is now renamed to NEXT_PUBLIC_API_ORIGIN=https://staging-api.tactile.to, so once this CORS entry lands, staging web → staging API is a coherent path.

DONE WHEN: `rg 'staging\.tactile\.to' apps/api/tactile-api/src/utils/cors.ts` matches, pnpm verify is no worse than the main baseline, and a preflight OPTIONS to /api/form/<hash>/submit with Origin: https://staging.tactile.to returns 204 rather than 403.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Backend API

Add staging.tactile.to to the API CORS allowlist