Assert the retired proof headers stay off the CORS allowlist

[seribaymadina]

A browser only sends a request whose headers the preflight approved, so putting X-EA-Token or X-Internal-Key back on the allowlist is not a narrow early-access regression: any client still sending one has its request cancelled before it leaves the browser, every leaderboard renders empty including the public rows, and nothing reaches a server to log it. That is how the last one went unnoticed.

#521 left the positive case for Authorization; this is its negative twin. Test-only, and it can fail only if CORS is re-widened.

Verified by mutation: re-adding both headers to allow_headers fails both cases, reverting passes. Fixes the client side in coval-ai/benchmarks-web#47.

Greptile Summary

The PR adds regression coverage ensuring the retired X-Internal-Key and X-EA-Token headers remain excluded from CORS preflight approval.

• Parameterizes both retired proof headers.
• Verifies each preflight is rejected and omitted from Access-Control-Allow-Headers.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

_{Reviews (2): Last reviewed commit: "Assert the retired proof headers stay of..." | Re-trigger Greptile}

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e86cc808-a538-4a21-9a3b-5c1e24c2867a

📥 Commits

Reviewing files that changed from the base of the PR and between 648d59a and d4600aa.

📒 Files selected for processing (1)

• runner/tests/api/test_cors.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The CORS API tests now import pytest and add a parametrized preflight test. The test covers the retired x-internal-key and x-ea-token headers. Each request must return HTTP 400. Neither header may appear in the CORS allowed-header list.

Suggested reviewers: coval-cale

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the regression tests for retired proof headers in the CORS allowlist.
Description check	✅ Passed	The description directly explains the CORS regression tests, their purpose, verification, and relationship to the changeset.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coval-cale]

Does this involve network calls or is this locally mocked? Cause if it's network calls we should refactor this test suite to not use them.

[seribaymadina]

Locally mocked — no network. The client fixture uses ASGITransport(app=app) against base_url="http://test" (tests/api/conftest.py:346), so requests go straight into the ASGI app in-process; conftest's module docstring says the same on line 12. Nothing to refactor here.

Separately, you prompted a rethink of the test itself and I've replaced it in 8f4936e. The parametrized negative only caught headers being added to the allowlist — but this outage came from one being removed: #521 dropped X-EA-Token/X-Internal-Key while the dashboard still sent them, and my test would have passed happily through that. It was guarding the wrong direction.

It now asserts the allowlist is exactly {accept, accept-language, authorization, content-language, content-type}, so either direction fails. Mutation-checked both ways: adding X-EA-Token fails it, and dropping Authorization (the #521 shape) fails it too.

Worth being blunt about the limit: this pins the server's side only. It can't see what the dashboard sends, so it turns a silent narrowing into a failing test that asks "what still sends this?" rather than actually verifying the contract. The real guard is a cross-repo check that the client's header set is a subset of this one — happy to file that separately if it's worth it.

Client-side fix is coval-ai/benchmarks-web#47.