From 544d52f1a22d580be72274dfa56493e30a2c6dcd Mon Sep 17 00:00:00 2001
From: CattonNyan <kkt991208@gmail.com>
Date: Mon, 7 Sep 2026 16:11:06 +0900
Subject: [PATCH] fix(cors): allow PATCH in restricted policy

---
 .../appsettings.Production.json               |  2 +-
 src/Host/FSH.Starter.Api/appsettings.json     |  2 +-
 .../Framework.Tests/Framework.Tests.csproj    |  9 ++++++
 .../Web/CorsConfigurationTests.cs             | 29 +++++++++++++++++++
 4 files changed, 40 insertions(+), 2 deletions(-)
 create mode 100644 src/Tests/Framework.Tests/Web/CorsConfigurationTests.cs

diff --git a/src/Host/FSH.Starter.Api/appsettings.Production.json b/src/Host/FSH.Starter.Api/appsettings.Production.json
index 332724534b..17e7924e40 100644
--- a/src/Host/FSH.Starter.Api/appsettings.Production.json
+++ b/src/Host/FSH.Starter.Api/appsettings.Production.json
@@ -60,7 +60,7 @@
     "AllowAll": false,
     "AllowedOrigins": [],
     "AllowedHeaders": [ "content-type", "authorization" ],
-    "AllowedMethods": [ "GET", "POST", "PUT", "DELETE" ]
+    "AllowedMethods": [ "GET", "POST", "PUT", "PATCH", "DELETE" ]
   },
   "JwtOptions": {
     "Issuer": "fsh.local",
diff --git a/src/Host/FSH.Starter.Api/appsettings.json b/src/Host/FSH.Starter.Api/appsettings.json
index 293fdfebb6..f21c4e52ce 100644
--- a/src/Host/FSH.Starter.Api/appsettings.json
+++ b/src/Host/FSH.Starter.Api/appsettings.json
@@ -101,7 +101,7 @@
       "http://localhost:5174"
     ],
     "AllowedHeaders": [ "content-type", "authorization" ],
-    "AllowedMethods": [ "GET", "POST", "PUT", "DELETE" ]
+    "AllowedMethods": [ "GET", "POST", "PUT", "PATCH", "DELETE" ]
   },
   "JwtOptions": {
     "Issuer": "fsh.local",
diff --git a/src/Tests/Framework.Tests/Framework.Tests.csproj b/src/Tests/Framework.Tests/Framework.Tests.csproj
index 89ec11ee87..8bc68c1bd3 100644
--- a/src/Tests/Framework.Tests/Framework.Tests.csproj
+++ b/src/Tests/Framework.Tests/Framework.Tests.csproj
@@ -32,4 +32,13 @@
 		<ProjectReference Include="..\..\BuildingBlocks\Web\Web.csproj" />
 	</ItemGroup>
 
+	<ItemGroup>
+		<None Include="..\..\Host\FSH.Starter.Api\appsettings.json"
+			  Link="HostConfiguration\appsettings.json"
+			  CopyToOutputDirectory="PreserveNewest" />
+		<None Include="..\..\Host\FSH.Starter.Api\appsettings.Production.json"
+			  Link="HostConfiguration\appsettings.Production.json"
+			  CopyToOutputDirectory="PreserveNewest" />
+	</ItemGroup>
+
 </Project>
diff --git a/src/Tests/Framework.Tests/Web/CorsConfigurationTests.cs b/src/Tests/Framework.Tests/Web/CorsConfigurationTests.cs
new file mode 100644
index 0000000000..a8b65f55ef
--- /dev/null
+++ b/src/Tests/Framework.Tests/Web/CorsConfigurationTests.cs
@@ -0,0 +1,29 @@
+using System.Text.Json;
+
+namespace Framework.Tests.Web;
+
+public sealed class CorsConfigurationTests
+{
+    [Theory]
+    [InlineData("appsettings.json")]
+    [InlineData("appsettings.Production.json")]
+    public void AllowedMethods_Should_IncludePatch_When_RestrictedCorsIsConfigured(string fileName)
+    {
+        // Arrange
+        string path = Path.Combine(AppContext.BaseDirectory, "HostConfiguration", fileName);
+
+        // Act
+        using JsonDocument document = JsonDocument.Parse(File.ReadAllText(path));
+        JsonElement corsOptions = document.RootElement.GetProperty("CorsOptions");
+        string[] allowedMethods = corsOptions
+            .GetProperty("AllowedMethods")
+            .EnumerateArray()
+            .Select(method => method.GetString())
+            .OfType<string>()
+            .ToArray();
+
+        // Assert
+        corsOptions.GetProperty("AllowAll").GetBoolean().ShouldBeFalse();
+        allowedMethods.ShouldContain("PATCH");
+    }
+}