Allow cross-origin reads of public v2 responses

src/adsb_api/app.py

@@ -88,6 +88,15 @@ async def get_http_session() -> aiohttp.ClientSession:
     },
 )
 
+
+@app.middleware("http")
+async def add_v2_cors_header(request: Request, call_next):
+    response = await call_next(request)
+    if request.url.path.startswith("/v2/"):
+        response.headers["Access-Control-Allow-Origin"] = "*"
+    return response
+
+
 app.include_router(v2_router)
 app.include_router(routes_router)
 app.include_router(tar_router)

tests/test_api.py

@@ -207,6 +207,19 @@ async def test_v2_radius(mock_happy_reapi, test_client):
     assert resp["msg"] == "No error"
 
 
+def test_v2_responses_allow_cross_origin_reads(test_client):
+    response = test_client.get(
+        "/v2/not-a-route",
+        headers={"Origin": "https://example.com"},
+    )
+
+    assert response.headers["access-control-allow-origin"] == "*"
+    assert "access-control-allow-origin" not in test_client.get(
+        "/docs",
+        headers={"Origin": "https://example.com"},
+    ).headers
+
+
 @pytest.mark.asyncio
 async def test_api_me(test_client):
     response = test_client.get("/api/0/me")