CHANGELOG.md

+## [1.4.7](https://code.castopod.org/adaures/castopod/compare/v1.4.6...v1.4.7) (2023-07-19)
+
+### Bug Fixes
+
+- **s3:** allow CORS for served static files
+  ([9b955c9](https://code.castopod.org/adaures/castopod/commit/9b955c9ce25a06a9102b67ebe77375dc45d28f0f))
+
 ## [1.4.6](https://code.castopod.org/adaures/castopod/compare/v1.4.5...v1.4.6) (2023-07-11)
 
 ### Bug Fixes

app/Config/Constants.php

@@ -11,7 +11,7 @@ declare(strict_types=1);
  |
  | NOTE: this constant is updated upon release with Continuous Integration.
  */
-defined('CP_VERSION') || define('CP_VERSION', '1.4.6');
+defined('CP_VERSION') || define('CP_VERSION', '1.4.7');
 
 /*
  | --------------------------------------------------------------------

app/Config/Filters.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace Config;
 
+use App\Filters\AllowCorsFilter;
 use CodeIgniter\Config\BaseConfig;
 use CodeIgniter\Filters\CSRF;
 use CodeIgniter\Filters\DebugToolbar;
@@ -12,7 +13,6 @@ use CodeIgniter\Filters\InvalidChars;
 use CodeIgniter\Filters\SecureHeaders;
 use Modules\Api\Rest\V1\Filters\ApiFilter;
 use Modules\Auth\Filters\PermissionFilter;
-use Modules\Fediverse\Filters\AllowCorsFilter;
 use Modules\Fediverse\Filters\FediverseFilter;
 use Modules\PremiumPodcasts\Filters\PodcastUnlockFilter;
 

modules/Fediverse/Filters/AllowCorsFilter.php → app/Filters/AllowCorsFilter.php

@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 
-namespace Modules\Fediverse\Filters;
+namespace App\Filters;
 
 use CodeIgniter\Filters\FilterInterface;
 use CodeIgniter\HTTP\RequestInterface;
@@ -17,11 +17,13 @@ class AllowCorsFilter implements FilterInterface
 
     public function after(RequestInterface $request, ResponseInterface $response, $arguments = null): void
     {
+        if (! $response->hasHeader('Cache-Control')) {
+            $response->setHeader('Cache-Control', 'public, max-age=86400');
+        }
+
         $response->setHeader('Access-Control-Allow-Origin', '*') // for allowing any domain, insecure
             ->setHeader('Access-Control-Allow-Headers', '*') // for allowing any headers, insecure
             ->setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS') // allows GET and OPTIONS methods only
-            ->setHeader('Access-Control-Max-Age', '86400')
-            ->setHeader('Cache-Control', 'public, max-age=86400')
-            ->setStatusCode(200);
+            ->setHeader('Access-Control-Max-Age', '86400');
     }
 }

composer.json

 {
   "name": "adaures/castopod",
-  "version": "1.4.6",
+  "version": "1.4.7",
   "type": "project",
   "description": "Castopod is an open-source hosting platform made for podcasters who want engage and interact with their audience.",
   "homepage": "https://castopod.org",

modules/Media/Config/Routes.php

@@ -13,4 +13,5 @@ $routes = service('routes');
 $routes->get('static/(:any)', 'MediaController::serve/$1', [
     'as'        => 'media-serve',
     'namespace' => 'Modules\Media\Controllers',
+    'filter'    => 'allow-cors',
 ]);

package.json

 {
   "name": "castopod",
-  "version": "1.4.6",
+  "version": "1.4.7",
   "description": "Castopod Host is an open-source hosting platform made for podcasters who want engage and interact with their audience.",
   "private": true,
   "license": "AGPL-3.0-or-later",