fix(cors): expose the API response headers a browser client needs

Without `Access-Control-Expose-Headers` a browser can read only the six
CORS-safelisted response headers, so the rate-limit budget, the `Retry-After`
a 429 or 503 asks the caller to observe, and the request/run correlation ids
were all on the wire but invisible to `fetch()`. Server-to-server callers were
unaffected, which is why it went unnoticed.

Exposed on the default `/api` policy only. The per-route `CORS_RULES` entries
are wildcard-origin public endpoints and opt in individually if they ever need
it, so this does not widen what an anonymous cross-origin caller can read from
them.

Author: waleedlatif1

apps/sim/proxy.test.ts

@@ -128,6 +128,8 @@ describe('resolveApiCorsPolicy', () => {
       origin: 'https://app.sim.test',
       credentials: true,
       methods: 'GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS',
+      exposeHeaders:
+        'Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-Request-Id, X-Run-Id',
       headers: expect.stringContaining('Authorization'),
     })
   })

apps/sim/proxy.ts

@@ -15,6 +15,8 @@ export interface CorsPolicy {
   credentials: boolean
   methods: string
   headers: string
+  /** Response headers a browser client may read; omitted leaves the CORS default. */
+  exposeHeaders?: string
 }
 
 /**
@@ -33,6 +35,19 @@ export interface CorsPolicy {
  */
 const DEFAULT_API_ALLOWED_METHODS = 'GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS'
 
+/**
+ * Response headers the `/api` surface sets that a browser client must be able to read.
+ *
+ * Without `Access-Control-Expose-Headers` a browser can read only the six
+ * CORS-safelisted response headers, so everything here is on the wire but
+ * invisible to `fetch()` — the rate-limit budget, the retry delay a 429 or 503
+ * asks the caller to observe, and the ids needed to correlate a run or a support
+ * report. Server-to-server callers are unaffected, which is why the gap is easy
+ * to miss.
+ */
+const DEFAULT_API_EXPOSED_HEADERS =
+  'Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-Request-Id, X-Run-Id'
+
 const DEFAULT_API_ALLOWED_HEADERS =
   'X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version, X-API-Key, Authorization'
 
@@ -127,6 +142,7 @@ export function resolveApiCorsPolicy(request: NextRequest): CorsPolicy {
     credentials: true,
     methods: DEFAULT_API_ALLOWED_METHODS,
     headers: DEFAULT_API_ALLOWED_HEADERS,
+    exposeHeaders: DEFAULT_API_EXPOSED_HEADERS,
   }
 }
 
@@ -137,6 +153,9 @@ function applyCorsHeaders(response: NextResponse, policy: CorsPolicy): void {
   response.headers.set('Access-Control-Allow-Credentials', String(policy.credentials))
   response.headers.set('Access-Control-Allow-Methods', policy.methods)
   response.headers.set('Access-Control-Allow-Headers', policy.headers)
+  if (policy.exposeHeaders) {
+    response.headers.set('Access-Control-Expose-Headers', policy.exposeHeaders)
+  }
   if (policy.origin !== '*') {
     response.headers.set('Vary', 'Origin')
   }