fix(task-024): make demo browser flow reachable

apps/backend/src/infrastructure/repositories.py

@@ -483,8 +483,6 @@ class ArticlesRepository:
                 {placeholder},
                 {placeholder},
                 {placeholder},
-                {placeholder},
-                {placeholder},
                 {placeholder}{json_cast},
                 {placeholder},
                 {placeholder},
@@ -493,6 +491,8 @@ class ArticlesRepository:
                 {placeholder},
                 {placeholder},
                 {placeholder},
+                {placeholder},
+                {placeholder},
                 {placeholder}
             )
         """

apps/backend/src/presentation/main.py

@@ -1,8 +1,10 @@
+import os
 from typing import Any
 
 from fastapi import FastAPI
 from fastapi.openapi.utils import get_openapi
 from fastapi.responses import JSONResponse
+from fastapi.middleware.cors import CORSMiddleware
 
 from src.domain.contracts.openapi import inject_contract_schemas
 from src.presentation.routes.agent_jobs import (
@@ -24,6 +26,21 @@ from src.presentation.routes.workflow_templates import router as workflow_templa
 
 
 app = FastAPI(title="AI Content Pipeline Backend")
+_allowed_origins = [
+    origin.strip()
+    for origin in os.getenv(
+        "PIPELINE_CORS_ALLOW_ORIGINS",
+        "http://localhost:3000,http://localhost:13300",
+    ).split(",")
+    if origin.strip()
+]
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=_allowed_origins,
+    allow_credentials=False,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
 app.include_router(auth_router)
 app.include_router(articles_router)
 app.include_router(assets_router)

apps/backend/tests/integration/test_demo_browser_cors_public_api.py

@@ -0,0 +1,56 @@
+from __future__ import annotations
+
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+from fastapi.testclient import TestClient
+
+
+BACKEND_ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(BACKEND_ROOT))
+
+from src.application.seed_data import seed_reference_data  # noqa: E402
+from src.infrastructure.repositories import open_backend_repository  # noqa: E402
+from src.presentation.dependencies import get_repository  # noqa: E402
+from src.presentation.main import app  # noqa: E402
+
+
+class DemoBrowserCorsPublicApiTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp_dir = tempfile.TemporaryDirectory()
+        dsn = f"sqlite:///{Path(self.tmp_dir.name) / 'demo-browser-cors.db'}"
+        self.repository = open_backend_repository(dsn)
+        self.repository.setup()
+        seed_reference_data(self.repository)
+        app.dependency_overrides[get_repository] = lambda: self.repository
+        self.client = TestClient(app)
+
+    def tearDown(self) -> None:
+        app.dependency_overrides.clear()
+        self.tmp_dir.cleanup()
+
+    def test_demo_frontend_origin_can_call_backend_with_demo_user_header(self) -> None:
+        response = self.client.options(
+            "/api/admin/workflows",
+            headers={
+                "Origin": "http://localhost:13300",
+                "Access-Control-Request-Method": "GET",
+                "Access-Control-Request-Headers": "X-Demo-User-Email",
+            },
+        )
+
+        self.assertEqual(200, response.status_code, response.text)
+        self.assertEqual(
+            "http://localhost:13300",
+            response.headers.get("access-control-allow-origin"),
+        )
+        self.assertIn(
+            "X-Demo-User-Email",
+            response.headers.get("access-control-allow-headers", ""),
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()