faucet: ignore cors

clients/bitwindow/lib/pages/root_page.dart

@@ -63,7 +63,6 @@ class RootPage extends StatelessWidget {
                         label: 'Sidechains',
                         active: tabsRouter.activeIndex == 2,
                         onTap: () => tabsRouter.setActiveIndex(2),
-                        end: true,
                       ),
                       QtTab(
                         icon: SailSVGAsset.iconLearn,

clients/bitwindow/lib/pages/sidechains_page.dart

@@ -347,6 +347,11 @@ class SidechainsViewModel extends BaseViewModel {
     notifyListeners();
   }
 
+  void formatAddress() {
+    addressController.text = formatDepositAddress(addressController.text, _selectedIndex ?? 254);
+    notifyListeners();
+  }
+
   void deposit(BuildContext context) async {
     if (double.tryParse(depositAmountController.text) == null) {
       showSnackBar(context, 'Invalid amount, enter a number');
@@ -456,11 +461,11 @@ class MakeDepositsView extends ViewModelWidget<SidechainsViewModel> {
                 ),
               ),
               QtIconButton(
-                tooltip: 'Clear',
-                onPressed: viewModel.clearAddress,
-                icon: Icon(
-                  Icons.cancel_outlined,
-                  size: 20.0,
+                tooltip: 'Format Deposit Address',
+                onPressed: viewModel.formatAddress,
+                icon: SailSVG.fromAsset(
+                  SailSVGAsset.iconFormat,
+                  width: 20,
                   color: context.sailTheme.colors.text,
                 ),
               ),

clients/faucet/lib/api/api.dart

@@ -19,11 +19,13 @@ class APILive extends API {
 
   @override
   CallOptions createOptions() {
-    final timeout = Duration(
-      seconds: 3,
-    );
+    final timeout = Duration(seconds: 3);
     final providers = [
-      (metadata, uri) async {},
+      (metadata, uri) async {
+        // Add any headers needed for CORS
+        metadata['Origin'] = 'https://${Environment.apiHost}';
+        metadata['Accept-Encoding'] = 'gzip';
+      },
     ];
     try {
       return getCallOptions(
@@ -33,7 +35,7 @@ class APILive extends API {
     } catch (error) {
       log.e('could not create callOptions: ${error.toString()}');
       return CallOptions();
-    } finally {}
+    }
   }
 }
 

clients/sail_ui/lib/widgets/core/sail_svg.dart

@@ -31,6 +31,7 @@ enum SailSVGAsset {
   iconDropdown,
   iconDeposit,
   iconWithdraw,
+  iconFormat,
 
   iconHome,
   iconSend,
@@ -187,6 +188,9 @@ extension AsAssetPath on SailSVGAsset {
       case SailSVGAsset.iconWithdraw:
         return 'assets/svgs/icon_withdraw.svg';
 
+      case SailSVGAsset.iconFormat:
+        return 'assets/svgs/icon_format.svg';
+
       case SailSVGAsset.iconHome:
         return 'assets/svgs/icon_home.svg';
       case SailSVGAsset.iconSend:

servers/faucet/server/server.go

@@ -55,8 +55,14 @@ type Server struct {
 }
 
 func (s *Server) Handler(ctx context.Context) http.Handler {
-
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Add CSP header
+		w.Header().Set("Content-Security-Policy",
+			"default-src 'self'; "+
+				"connect-src 'self' ws: wss: http: https:; "+
+				"script-src 'self' 'wasm-unsafe-eval' 'unsafe-eval'; "+ // Allow eval for gRPC-web
+				"style-src 'self' 'unsafe-inline'")
+
 		// If the body is completely empty, replace it with the
 		// empty object. This makes it possible to send requests
 		// without a body, without getting a cryptic error.
@@ -66,27 +72,27 @@ func (s *Server) Handler(ctx context.Context) http.Handler {
 
 		corsHandler := cors.New(cors.Options{
 			AllowedOrigins: []string{
-				"https://drivechain.live",
+				"*", // For development. In production, specify exact origins
 			},
 			AllowedMethods: []string{"GET", "POST", "DELETE", "OPTIONS", "PATCH"},
 			AllowedHeaders: []string{
-				"Connect-Protocol-Version", "Content-Type", "Connect-Protocol-Version", "Content-Type", "Accept",
-
-				"Connect-Accept-Encoding", "Connect-Content-Encoding",
-				"Grpc-Timeout",
-
-				"X-Grpc-Web", "X-User-Agent",
-				"Access-Control-Allow-Origin",
+				"Connect-Protocol-Version", "Content-Type", "Connect-Protocol-Version",
+				"Content-Type", "Accept", "Connect-Accept-Encoding",
+				"Connect-Content-Encoding", "Grpc-Timeout", "X-Grpc-Web",
+				"X-User-Agent", "Access-Control-Allow-Origin",
 				"Access-Control-Request-Headers",
+				"Content-Security-Policy", // Allow CSP header
+				"Origin",                  // Important for CORS preflight
+				"Accept-Encoding",         // Allow compression negotiation
 			},
 			ExposedHeaders: []string{
-				"Content-Encoding",
-				"Connect-Content-Encoding",
-				"Grpc-Status",
-				"Grpc-Message",
+				"Content-Encoding", "Connect-Content-Encoding",
+				"Grpc-Status", "Grpc-Message",
 				"Access-Control-Allow-Origin",
 				"Access-Control-Request-Headers",
+				"Content-Security-Policy", // Expose CSP header
 			},
+			AllowCredentials: true, // Allow credentials
 		})
 
 		withCORS := corsHandler.Handler(s.mux)