Fix CORS methods parsing to support wildcard

[railway-app]

Problem

FastAPI's CORSMiddleware rejects "*" as an HTTP method value, so when CORS_METHODS is set to "*" the existing comma-split logic produces ["*"], which the middleware cannot recognise. This causes every CORS preflight OPTIONS request to /api/v1/contact-messages to fail with HTTP 400, breaking the contact form.

Solution

Updated cors_methods_list in app/config/settings.py to detect the wildcard and return the full list of real HTTP method names (GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD, TRACE, CONNECT) instead of passing "*" directly to the middleware. The cors_headers_list property is also guarded to return ["*"] explicitly when the wildcard is set, since FastAPI does accept "*" for headers. Non-wildcard values continue to be split by comma as before.

Changes

• Modified app/config/settings.py

---

Generated by Railway

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!