feat: auth flow

js/src/main.ts

@@ -1,4 +1,4 @@
-import { app, BrowserWindow } from 'electron';
+import { app, BrowserWindow, session } from 'electron';
 import path from 'node:path';
 import started from 'electron-squirrel-startup';
 
@@ -33,7 +33,28 @@ const createWindow = () => {
 // This method will be called when Electron has finished
 // initialization and is ready to create browser windows.
 // Some APIs can only be used after this event occurs.
-app.on('ready', createWindow);
+app.on('ready', () => {
+  // Allow CORS for API requests from the renderer process.
+  // The server doesn't handle OPTIONS preflight, so we intercept at the
+  // Electron network layer: inject CORS headers and return 200 for preflight.
+  session.defaultSession.webRequest.onHeadersReceived(
+    { urls: ['https://orion.dev.flowy.live/*'] },
+    (details, callback) => {
+      const headers = { ...details.responseHeaders };
+      headers['access-control-allow-origin'] = ['*'];
+      headers['access-control-allow-headers'] = ['Content-Type', 'Authorization'];
+      headers['access-control-allow-methods'] = ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'];
+
+      if (details.method === 'OPTIONS') {
+        callback({ responseHeaders: headers, statusLine: 'HTTP/1.1 200 OK' });
+      } else {
+        callback({ responseHeaders: headers });
+      }
+    },
+  );
+
+  createWindow();
+});
 
 // Quit when all windows are closed, except on macOS. There, it's common
 // for applications and their menu bar to stay active until the user quits