Fix ladl.link CORS for Mini payment assets and pay URL.

Allow cross-origin module loads of Mini build assets and use a same-origin pay path when HTML is proxied through ladl.link so fetch and Vite JS work.
2026-07-21 22:05:36 +00:00
parent e03a5dc30f
commit 75d201bcae
4 changed files with 124 additions and 5 deletions
@@ -0,0 +1,41 @@
+<?php
+
+/**
+ * Public Mini payment pages are HTML-proxied through ladl.link while Vite assets
+ * and Mini pay endpoints live on mini.ladill.com. Browsers require CORS for those
+ * cross-origin module scripts and JSON pay posts.
+ */
+return [
+
+    'paths' => [
+        'q/*',
+        'build/*',
+        'images/*',
+        'sanctum/csrf-cookie',
+    ],
+
+    'allowed_methods' => ['*'],
+
+    'allowed_origins' => array_values(array_filter([
+        'https://ladl.link',
+        'https://www.ladl.link',
+        'https://mini.ladill.com',
+        env('APP_URL') ? rtrim((string) env('APP_URL'), '/') : null,
+    ])),
+
+    'allowed_origins_patterns' => [
+        // Public short-link host and optional subdomains.
+        '#^https://([a-z0-9-]+\.)?ladl\.link$#i',
+        // Platform family (custom / satellite hosts that may proxy Mini HTML).
+        '#^https://([a-z0-9-]+\.)?ladill\.com$#i',
+    ],
+
+    'allowed_headers' => ['*'],
+
+    'exposed_headers' => [],
+
+    'max_age' => 60 * 60,
+
+    'supports_credentials' => false,
+
+];