[Devin] fix: add CORS headers to mock API server

[devin-ai-integration]

What

The mock API server has no CORS headers on any route. When the frontend runs on a different origin during development (e.g., localhost:5173 calling localhost:3001), all cross-origin requests fail with CORS errors. This prevents the frontend from communicating with the API in a standard dev setup.

Where

File: api/mock-server.js
Lines: 13–20 (where CORS middleware should be)

How I found it

• Static analysis: The code contained a commented-out CORS middleware block with a comment: // BUG: Missing CORS headers on all routes. Cross-referencing with the frontend confirmed that fetch() calls to /api/* would fail cross-origin.
• HTTP scan: Made requests with an Origin header — no Access-Control-Allow-Origin header was present in responses.

Evidence

HTTP scan output (no CORS headers in response):

curl -I -H "Origin: https://example.com" https://devin-ai-kata.vercel.app/api/products
→ No Access-Control-Allow-Origin header present

Fix

Added CORS middleware that:

• Sets Access-Control-Allow-Origin: *
• Sets Access-Control-Allow-Headers: Content-Type
• Sets Access-Control-Allow-Methods: GET, POST, OPTIONS
• Handles OPTIONS preflight requests with 204 response

Confidence

High — The commented-out code explicitly documented this as a bug. Standard CORS middleware pattern.

Summary

Adds CORS middleware to the mock API server so cross-origin frontend requests work during development.

Review & Testing Checklist for Human

• Run the mock server locally (node api/mock-server.js) and make a cross-origin request — verify CORS headers are present
• Verify OPTIONS preflight requests return 204

Notes

Found via static analysis — the code contained a commented-out CORS block that was never activated.

Link to Devin session: https://app.devin.ai/sessions/3b3d59c7eee04cea9069529fd6fff39d
Requested by: @scoobycoder

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
devin-ai-kata	Ready	Preview, Comment	Apr 26, 2026 7:49pm