CHANGELOG.md

+# [1.0.0-alpha.67](https://code.podlibre.org/podlibre/castopod-host/compare/v1.0.0-alpha.66...v1.0.0-alpha.67) (2021-07-24)
+
+### Features
+
+- allow cross origin requests on episode comments
+  ([e12f95a](https://code.podlibre.org/podlibre/castopod-host/commit/e12f95aca13c6d54489a9cfd99d4cd2490fe83ab))
+
 # [1.0.0-alpha.66](https://code.podlibre.org/podlibre/castopod-host/compare/v1.0.0-alpha.65...v1.0.0-alpha.66) (2021-07-24)
 
 ### Features

app/Config/Constants.php

@@ -11,7 +11,7 @@ declare(strict_types=1);
  |
  | NOTE: this constant is updated upon release with Continuous Integration.
  */
-defined('CP_VERSION') || define('CP_VERSION', '1.0.0-alpha.66');
+defined('CP_VERSION') || define('CP_VERSION', '1.0.0-alpha.67');
 
 /*
  | --------------------------------------------------------------------

app/Config/Routes.php

@@ -736,6 +736,7 @@ $routes->group('@(:podcastName)', function ($routes): void {
                 ],
             ],
         ]);
+        $routes->options('comments', 'EpisodeController::commentsPreflight/$1/$2');
         $routes->get('comments', 'EpisodeController::comments/$1/$2', [
             'as' => 'episode-comments',
             'application/activity+json' => [

app/Controllers/EpisodeController.php

@@ -210,6 +210,19 @@ class EpisodeController extends BaseController
             ->setBody($podcastObject->toJSON());
     }
 
+    /**
+     * @noRector ReturnTypeDeclarationRector
+     */
+    public function commentsPreflight(): Response
+    {
+        return $this->response->setHeader('Access-Control-Allow-Origin', '*') // for allowing any domain, insecure
+            ->setHeader('Access-Control-Allow-Headers', '*') // for allowing any headers, insecure
+            ->setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS') // allows GET and OPTIONS methods only
+            ->setHeader('Access-Control-Max-Age', '86400')
+            ->setHeader('Cache-Control', 'public, max-age=86400')
+            ->setStatusCode(200);
+    }
+
     /**
      * @noRector ReturnTypeDeclarationRector
      */
@@ -250,6 +263,7 @@ class EpisodeController extends BaseController
 
         return $this->response
             ->setContentType('application/activity+json')
+            ->setHeader('Access-Control-Allow-Origin', '*')
             ->setBody($collection->toJSON());
     }
 }

composer.json

 {
   "name": "podlibre/castopod-host",
-  "version": "1.0.0-alpha66",
+  "version": "1.0.0-alpha67",
   "type": "project",
   "description": "Castopod Host is an open-source hosting platform made for podcasters who want engage and interact with their audience.",
   "homepage": "https://castopod.org",

package-lock.json

 {
   "name": "castopod-host",
-  "version": "1.0.0-alpha.66",
+  "version": "1.0.0-alpha.67",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
-      "version": "1.0.0-alpha.66",
+      "version": "1.0.0-alpha.67",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "@amcharts/amcharts4": "^4.10.17",

package.json

 {
   "name": "castopod-host",
-  "version": "1.0.0-alpha.66",
+  "version": "1.0.0-alpha.67",
   "description": "Castopod Host is an open-source hosting platform made for podcasters who want engage and interact with their audience.",
   "private": true,
   "license": "AGPL-3.0-or-later",