Move the Access Control headers to a middleware.

config/Middlewares.php

@@ -2,10 +2,11 @@
 
 declare(strict_types=1);
 
-use App\Libs\Middlewares\{APIKeyRequiredMiddleware, NoAccessLogMiddleware, ParseJsonBodyMiddleware};
+use App\Libs\Middlewares\{AddCorsMiddleware, APIKeyRequiredMiddleware, NoAccessLogMiddleware, ParseJsonBodyMiddleware};
 
 return static fn(): array => [
     fn() => new APIKeyRequiredMiddleware(),
     fn() => new ParseJsonBodyMiddleware(),
     fn() => new NoAccessLogMiddleware(),
+    fn() => new AddCorsMiddleware(),
 ];

src/API/Logs/Index.php

@@ -268,8 +268,6 @@ final class Index
                 'Cache-Control' => 'no-cache',
                 'Connection' => 'keep-alive',
                 'X-Accel-Buffering' => 'no',
-                'Access-Control-Allow-Origin' => '*',
-                'Access-Control-Allow-Credentials' => 'true',
             ],
             body: StreamClosure::create($callable)
         ))->withoutHeader('Content-Length');

src/API/System/Command.php

@@ -139,8 +139,6 @@ final class Command
                 'Cache-Control' => 'no-cache',
                 'Connection' => 'keep-alive',
                 'X-Accel-Buffering' => 'no',
-                'Access-Control-Allow-Origin' => '*',
-                'Access-Control-Allow-Credentials' => 'true',
                 'Last-Event-Id' => time(),
             ],
             body: StreamClosure::create($callable)

src/Libs/Initializer.php

@@ -289,7 +289,8 @@ final class Initializer
                 return $response;
             }
 
-            return (new ServeStatic())->serve($request);
+            return (new ServeStatic())->serve($request)->withHeader('Access-Control-Allow-Origin', '*')
+                ->withHeader('Access-Control-Allow-Credentials', 'true');
         }
 
         $configFile = ConfigFile::open(Config::get('backends_file'), 'yaml', autoCreate: true);
@@ -389,10 +390,7 @@ final class Initializer
             }
         })();
 
-        $response = $router->dispatch($realRequest);
-
-        return $response->withHeader('Access-Control-Allow-Origin', '*')
-            ->withHeader('Access-Control-Allow-Credentials', 'true');
+        return $router->dispatch($realRequest);
     }
 
     /**

src/Libs/Middlewares/AddCorsMiddleware.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Libs\Middlewares;
+
+use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\ServerRequestInterface;
+use Psr\Http\Server\MiddlewareInterface;
+use Psr\Http\Server\RequestHandlerInterface;
+
+final class AddCorsMiddleware implements MiddlewareInterface
+{
+    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
+    {
+        return $handler->handle($request)->withHeader('Access-Control-Allow-Origin', '*')
+            ->withHeader('Access-Control-Allow-Credentials', 'true');
+    }
+}