fix(task-024): make demo browser flow reachable

apps/backend/tests/integration/test_demo_browser_cors_public_api.py

@@ -0,0 +1,56 @@
+from __future__ import annotations
+
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+from fastapi.testclient import TestClient
+
+
+BACKEND_ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(BACKEND_ROOT))
+
+from src.application.seed_data import seed_reference_data  # noqa: E402
+from src.infrastructure.repositories import open_backend_repository  # noqa: E402
+from src.presentation.dependencies import get_repository  # noqa: E402
+from src.presentation.main import app  # noqa: E402
+
+
+class DemoBrowserCorsPublicApiTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp_dir = tempfile.TemporaryDirectory()
+        dsn = f"sqlite:///{Path(self.tmp_dir.name) / 'demo-browser-cors.db'}"
+        self.repository = open_backend_repository(dsn)
+        self.repository.setup()
+        seed_reference_data(self.repository)
+        app.dependency_overrides[get_repository] = lambda: self.repository
+        self.client = TestClient(app)
+
+    def tearDown(self) -> None:
+        app.dependency_overrides.clear()
+        self.tmp_dir.cleanup()
+
+    def test_demo_frontend_origin_can_call_backend_with_demo_user_header(self) -> None:
+        response = self.client.options(
+            "/api/admin/workflows",
+            headers={
+                "Origin": "http://localhost:13300",
+                "Access-Control-Request-Method": "GET",
+                "Access-Control-Request-Headers": "X-Demo-User-Email",
+            },
+        )
+
+        self.assertEqual(200, response.status_code, response.text)
+        self.assertEqual(
+            "http://localhost:13300",
+            response.headers.get("access-control-allow-origin"),
+        )
+        self.assertIn(
+            "X-Demo-User-Email",
+            response.headers.get("access-control-allow-headers", ""),
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()