CORS: PATCH is missing from AllowedMethods, blocking existing PATCH APIs under the restricted policy

[CattonNyan]

Summary

The shipped CORS configuration does not include PATCH in CorsOptions.AllowedMethods.

However, the API exposes several PATCH endpoints, and both React clients call them. When the frontend and API are hosted on different origins with CorsOptions.AllowAll=false, the browser rejects the preflight request before it reaches the API.

This is hidden during normal local development because appsettings.Development.json sets CorsOptions.AllowAll to true, which calls AllowAnyMethod().

Where

The following files currently allow only GET, POST, PUT, and DELETE:

• src/Host/FSH.Starter.Api/appsettings.json
• src/Host/FSH.Starter.Api/appsettings.Production.json

The restricted CORS branch passes that list directly to:

.WithMethods(settings.AllowedMethods)

in:

• src/BuildingBlocks/Web/Cors/Extensions.cs

Existing PATCH endpoints

The backend currently exposes PATCH endpoints for:

• Changing a product price
• Adjusting product stock
• Changing file visibility
• Toggling user status

Both clients/admin and clients/dashboard send requests using method: "PATCH" for these operations.

Minimal reproduction

Configure the API with a restricted CORS policy:

"CorsOptions": {
  "AllowAll": false,
  "AllowedOrigins": [
    "http://localhost:5174"
  ],
  "AllowedHeaders": [
    "content-type",
    "authorization",
    "tenant"
  ],
  "AllowedMethods": [
    "GET",
    "POST",
    "PUT",
    "DELETE"
  ]
}

The tenant header is included above to isolate this issue from #1367.

1. Run the API.
2. Run clients/dashboard at http://localhost:5174.
3. Sign in and try to change a product price or adjust its stock.
4. Alternatively, try to change a file's visibility.
5. Inspect the browser network panel and console.

The browser sends an OPTIONS preflight with:

Access-Control-Request-Method: PATCH

Because PATCH is absent from Access-Control-Allow-Methods, the browser blocks the request before it reaches the PATCH endpoint.

Expected behavior

Existing PATCH API calls should be allowed when the requesting origin and headers are otherwise permitted by the restricted CORS policy.

Actual behavior

Cross-origin PATCH calls are rejected during the browser's CORS preflight.

Suggested fix

Add "PATCH" to CorsOptions.AllowedMethods in both shipped configuration files:

"AllowedMethods": [
  "GET",
  "POST",
  "PUT",
  "PATCH",
  "DELETE"
]

A regression test covering the restricted CORS policy would also help prevent the method list from drifting away from the API's supported methods.

Environment

• .NET SDK: 10.0.100
• Database provider: PostgreSQL
• Affected configuration: CorsOptions.AllowAll=false