joebasser.com / atmosphere-account
this repo has no description
10
fork

Configure Feed

Select the types of activity you want to include in your feed.

fix: CORS + CORP + inline disposition on public banner image responses

Some clients (including possible Bluesky composer fetch paths) validate
og:image via cross-origin fetch rather than plain <img>. Add
Access-Control-Allow-Origin: *, Cross-Origin-Resource-Policy: cross-origin,
and Content-Disposition: inline on /api/registry/banner and /og-banner.

Made-with: Cursor

Joe Basser 18551ea1 a8e05916

+16 -8
+3
routes/api/registry/banner/[did].ts
··· 42 42 "public, max-age=3600, s-maxage=86400, stale-while-revalidate=86400", 43 43 ); 44 44 headers.set("etag", profile.bannerCid); 45 + headers.set("content-disposition", "inline"); 46 + headers.set("access-control-allow-origin", "*"); 47 + headers.set("cross-origin-resource-policy", "cross-origin"); 45 48 return new Response(upstream.body, { status: 200, headers }); 46 49 } catch (err) { 47 50 console.warn("[banner] proxy error:", err);
+13 -8
routes/api/registry/og-banner/[did].ts
··· 37 37 const img = await Image.decode(buf); 38 38 const cov = img.cover(OG_W, OG_H); 39 39 const jpeg = await cov.encodeJPEG(JPEG_QUALITY); 40 + const headers = new Headers({ 41 + "content-type": "image/jpeg", 42 + "cache-control": 43 + "public, max-age=3600, s-maxage=86400, stale-while-revalidate=86400", 44 + "etag": `${profile.bannerCid}-og`, 45 + "content-disposition": 'inline; filename="og-banner.jpg"', 46 + "access-control-allow-origin": "*", 47 + "cross-origin-resource-policy": "cross-origin", 48 + }); 40 49 return new Response( 41 50 new Blob([new Uint8Array(jpeg)], { type: "image/jpeg" }), 42 - { 43 - status: 200, 44 - headers: { 45 - "cache-control": 46 - "public, max-age=3600, s-maxage=86400, stale-while-revalidate=86400", 47 - "etag": `${profile.bannerCid}-og`, 48 - }, 49 - }, 51 + { status: 200, headers }, 50 52 ); 51 53 } catch (err) { 52 54 console.warn("[og-banner] resize failed, serving raw bytes:", err); ··· 58 60 "cache-control": 59 61 "public, max-age=3600, s-maxage=86400, stale-while-revalidate=86400", 60 62 "etag": profile.bannerCid, 63 + "content-disposition": "inline", 64 + "access-control-allow-origin": "*", 65 + "cross-origin-resource-policy": "cross-origin", 61 66 }, 62 67 }); 63 68 }