Guard download headers for R2 public URLs

lib/api/image-api.test.ts

@@ -19,6 +19,12 @@ vi.mock("@/lib/pollinations-api", () => ({
     },
 }))
 
+vi.mock("@/lib/config/api.config", () => ({
+    API_CONFIG: {
+        baseUrl: "https://gen.pollinations.ai",
+    },
+}))
+
 const mockFetch = vi.fn()
 
 describe("image-api", () => {
@@ -169,19 +175,35 @@ describe("image-api", () => {
                 blob: async () => mockBlob,
             })
 
-            const result = await downloadImage("https://example.com/img.png")
+            const pollinationsUrl = "https://gen.pollinations.ai/image/test.png"
+            const result = await downloadImage(pollinationsUrl)
 
             expect(result).toBe(mockBlob)
             expect(mockFetch).toHaveBeenCalledWith(
-                "https://example.com/img.png",
+                pollinationsUrl,
                 expect.objectContaining({
                     headers: { "Authorization": "Bearer test-token" },
                 })
             )
         })
 
+        it("skips auth headers for non-pollinations URLs", async () => {
+            const mockBlob = new Blob(["data"], { type: "image/png" })
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                status: 200,
+                blob: async () => mockBlob,
+            })
+
+            const result = await downloadImage("https://example.com/img.png")
+
+            expect(result).toBe(mockBlob)
+            expect(mockFetch).toHaveBeenCalledWith("https://example.com/img.png", undefined)
+        })
+
         it("falls back to no-header fetch on initial failure", async () => {
             const mockBlob = new Blob(["data"], { type: "image/png" })
+            const pollinationsUrl = "https://gen.pollinations.ai/image/test.png"
 
             // First call fails (e.g. 403 Forbidden with headers)
             mockFetch.mockResolvedValueOnce({
@@ -196,23 +218,23 @@ describe("image-api", () => {
                 blob: async () => mockBlob,
             })
 
-            const result = await downloadImage("https://example.com/img.png")
+            const result = await downloadImage(pollinationsUrl)
 
             expect(result).toBe(mockBlob)
             // Verify both calls were made
             expect(mockFetch).toHaveBeenCalledTimes(2)
             // First with headers
             expect(mockFetch).toHaveBeenNthCalledWith(
                 1,
-                "https://example.com/img.png",
+                pollinationsUrl,
                 expect.objectContaining({
                     headers: { "Authorization": "Bearer test-token" },
                 })
             )
             // Second without headers (undefined or empty options)
             expect(mockFetch).toHaveBeenNthCalledWith(
                 2,
-                "https://example.com/img.png"
+                pollinationsUrl
             )
         })
 

lib/api/image-api.ts

@@ -13,6 +13,7 @@ import {
     PollinationsApiError,
     isPollinationsApiError,
 } from "@/lib/errors"
+import { API_CONFIG } from "@/lib/config/api.config"
 import { PollinationsAPI } from "@/lib/pollinations-api"
 import {
     GeneratedImageSchema,
@@ -77,6 +78,16 @@ export async function generateImage(
     }
 }
 
+/**
+ * Returns true when the URL points at the Pollinations API origin.
+ * R2/public URLs should skip auth headers to avoid CORS/preflight failures.
+ */
+function shouldUsePollinationsHeaders(imageUrl: string): boolean {
+    const { origin } = new URL(imageUrl)
+    const pollinationsOrigin = new URL(API_CONFIG.baseUrl).origin
+    return origin === pollinationsOrigin
+}
+
 /**
  * Downloads an image as a blob.
  *
@@ -85,10 +96,15 @@ export async function generateImage(
  */
 export async function downloadImage(imageUrl: string): Promise<Blob> {
     try {
-        // Try with auth headers first
-        const response = await fetch(imageUrl, {
-            headers: PollinationsAPI.getHeaders(),
-        })
+        const headers = shouldUsePollinationsHeaders(imageUrl)
+            ? PollinationsAPI.getHeaders()
+            : undefined
+
+        // Only attach auth headers for Pollinations API URLs to avoid CORS errors on R2.
+        const response = await fetch(
+            imageUrl,
+            headers ? { headers } : undefined
+        )
 
         if (response.ok) {
             return response.blob()