From 777b7465b72bf5096c86718ce4cc0325045c4927 Mon Sep 17 00:00:00 2001
From: "2569718930@qq.com" <2569718930@qq.com>
Date: Tue, 26 May 2026 11:15:41 +0800
Subject: [PATCH] =?UTF-8?q?SSE=20CORS=20=E4=BF=AE=E5=A4=8D=EF=BC=9AEventSo?=
 =?UTF-8?q?urce=20=E8=B7=A8=E5=9F=9F=20+=20preflight=20OPTIONS?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- sse_router: 显式加 Access-Control-Allow-Origin + Allow-Credentials，新增 OPTIONS
- use-sse-patches: CORS 失败自动切 BFF 代理降级
---
 web/routers/sse_router.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/web/routers/sse_router.py b/web/routers/sse_router.py
index 06be4f5d..8ffa2ff9 100644
--- a/web/routers/sse_router.py
+++ b/web/routers/sse_router.py
@@ -13,9 +13,16 @@ from web.sse_manager import sse_manager
 router = APIRouter(tags=["events"])
 
 
+@router.options("/api/events")
+async def sse_events_preflight(request: Request):
+    return {"ok": True}
+
+
 @router.get("/api/events")
 async def sse_events(request: Request):
     user_id = getattr(request.state, "auth_user_id", None) or "anon"
+    origin = request.headers.get("origin", "")
+    allowed = origin in {"https://polyweather.top", "https://www.polyweather.top", "http://localhost:3000"}
     return StreamingResponse(
         sse_manager.event_stream(user_id),
         media_type="text/event-stream",
@@ -23,6 +30,8 @@ async def sse_events(request: Request):
             "Cache-Control": "no-cache, no-transform",
             "Connection": "keep-alive",
             "X-Accel-Buffering": "no",
+            "Access-Control-Allow-Origin": origin if allowed else "https://polyweather.top",
+            "Access-Control-Allow-Credentials": "true",
         },
     )