Feat/fix cookie store for cross origin

[manishdex25]

Summary

What is the background of this pull request?

Changes

• What are the changes made in this pull request?
• Change this and that, etc...

Issues

What are the related issues or stories?

Summary by CodeRabbit

Release Notes

• Bug Fixes

  • Fixed CSRF token response caching behavior to prevent stale token delivery.
  • Updated CORS configuration to properly handle cross-origin requests.

• Chores

  • Updated core library dependency to the latest stable version.

• Tests

  • Added regression test for CSRF token delivery with CORS handling.
  • Updated integration tests with latest document specifications.

[netlify]

✅ Deploy Preview for tradetrust-functions ready!

Name	Link
🔨 Latest commit	1d26b8c
🔍 Latest deploy log	https://app.netlify.com/projects/tradetrust-functions/deploys/6a06c6a80233b300076ea53a
😎 Deploy Preview	https://deploy-preview-87--tradetrust-functions.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

Warning

Rate limit exceeded

@manishdex25 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 26 minutes and 22 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 114d3668-f4a1-4198-b2db-d7c98193b8d3

📥 Commits

Reviewing files that changed from the base of the PR and between 61558d1 and 1d26b8c.

📒 Files selected for processing (4)

• netlify.toml
• netlify/functions/storage/index.ts
• netlify/functions/storage/router.ts
• tests/integration/headers.test.ts

📝 Walkthrough

Walkthrough

PR removes public CORS wildcard origin from Netlify configuration, adds Origin-aware Vary headers to serverless handlers, prevents CSRF-token conditional request caching via If-None-Match removal and Cache-Control headers, upgrades the @trustvc/trustvc dependency, and validates changes through test fixture migrations and new CORS regression coverage.

Changes

CORS and CSRF-Token Handling

Layer / File(s)	Summary
CORS Configuration and Middleware netlify.toml, netlify/functions/storage/index.ts, netlify/functions/verify/index.ts	Removes wildcard Access-Control-Allow-Origin header from static config and adds Express res.vary("Origin") middleware to storage and verify handlers to properly signal origin-dependent responses under serverless-http.
CSRF-Token Response Caching netlify/functions/storage/router.ts	Removes If-None-Match header from incoming requests before CSRF processing and sets Cache-Control: no-store on the response to prevent ETag-based conditional caching.
TrustVC Dependency Upgrade package.json	Bumps @trustvc/trustvc from ^2.0.7 to ^2.12.2.
Integration Test Fixtures and Regression Coverage tests/integration/document-storage.test.ts, tests/integration/document-verify.test.ts, tests/integration/headers.test.ts	Migrates document-storage and document-verify tests from v2 to v3 Sepolia fixtures; adds CSRF-token 304 CORS regression test that verifies conditional requests with matching ETags return 200 with proper CORS headers rather than 304; adds CORS allowlist test case for https://ref.tradetrust.io.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• TradeTrust/tradetrust-functions#86: Both PRs remove wildcard CORS origin from netlify.toml and add res.vary("Origin") middleware to the same serverless functions.
• TradeTrust/tradetrust-functions#83: Both PRs modify the /csrf-token endpoint in storage/router.ts, handling request/response header behavior for CSRF token delivery.
• TradeTrust/tradetrust-functions#74: Both PRs update the @trustvc/trustvc dependency version in package.json.

Suggested reviewers

• rongquan1
• RishabhS7

Poem

🐰 A hop toward origin-aware responses,
No wildcard CORS, just careful choices,
CSRF tokens now uncacheable and free,
Vary by Origin for all to see! 🎉

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The pull request description contains only empty template sections with no actual content filled in (Summary, Changes, and Issues sections are placeholders).	Complete all description sections: add background context, list specific changes made (CORS config, middleware, test additions), and reference related issues or stories.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Feat/fix cookie store for cross origin' is partially related to the changeset, referring to cross-origin functionality, but inadequately summarizes the main changes (CORS header removal, Origin middleware addition, CSRF token caching fixes).
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/fix-cookie-store-for-cross-origin

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/integration/document-storage.test.ts`:
- Line 22: The test fixture alias postDataSepoliaV2 is incorrectly assigned
documentSepoliaV3; update the test to restore a true v2 payload or rename the
alias and related test descriptions to v3 to match the fixture. Specifically,
replace the value of postDataSepoliaV2 to reference the correct v2 fixture
(e.g., documentSepoliaV2) or rename postDataSepoliaV2 to postDataSepoliaV3 and
update any test titles or expectations that reference "v2 sepolia" so they
consistently reflect v3 behavior; search for usages of postDataSepoliaV2 and
documentSepoliaV3 in document-storage.test.ts and update them together to keep
intent and coverage accurate.

In `@tests/integration/document-verify.test.ts`:
- Line 22: The test fixture alias postDataSepoliaV2 is incorrectly assigned
documentSepoliaV3; update the test to either use the correct v2 fixture (e.g.,
replace documentSepoliaV3 with documentSepoliaV2) or rename the alias and any
test labels to v3 for clarity; locate occurrences of postDataSepoliaV2 and
documentSepoliaV3 in the test file and make the alias and test descriptions
consistent (use documentSepoliaV2 for v2 tests or rename to postDataSepoliaV3
and adjust test names).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c8032855-172f-427a-8501-9e0cc495a5bc

📥 Commits

Reviewing files that changed from the base of the PR and between a7d041e and 61558d1.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (8)

• netlify.toml
• netlify/functions/storage/index.ts
• netlify/functions/storage/router.ts
• netlify/functions/verify/index.ts
• package.json
• tests/integration/document-storage.test.ts
• tests/integration/document-verify.test.ts
• tests/integration/headers.test.ts

💤 Files with no reviewable changes (1)

• netlify.toml