| @@ -36,8 +36,14 @@ | ||
| 36 | 36 | final class Cors { |
| 37 | 37 | /** |
| 38 | 38 | * POS-client request headers beyond WP core's CORS defaults. |
| 39 | 39 | * |
| 40 | + * FROZEN as the compatibility floor (free#1763): Rest_Cors pre-authorizes | |
| 41 | + * new client headers through preflight reflection, so adding a name only | |
| 42 | + * masks a reflection bug, while removing one narrows the degradation floor | |
| 43 | + * used when announcements are stripped and by old preflight caches. | |
| 44 | + * `X-WCPOS-Protocol` and `X-WCPOS-Client` (free#1760) are the last additions. | |
| 45 | + * | |
| 40 | 46 | * - `Idempotency-Key` / `If-Match` — the v2 write path's standard-header |
| 41 | 47 | * mirror ({@see Header_Mirror::HEADERS}). |
| 42 | 48 | * - `If-None-Match` — conditional sequence-log polling (304s). |
| 43 | 49 | * - `X-WCPOS-Idempotency-Key` — the checkout/refund lane's idempotency |
| @@ -43,8 +49,10 @@ | ||
| 43 | 49 | * - `X-WCPOS-Idempotency-Key` — the checkout/refund lane's idempotency |
| 44 | 50 | * key (v1-shaped, predates the ADR 0011 mirror). |
| 45 | 51 | * - `X-WCPOS-Store` — the till's store scope ({@see Store_Scope::HEADER}, |
| 46 | 52 | * pro#425). |
| 53 | + * - `X-WCPOS-Protocol` — protocol signal (wcpos/woocommerce-pos#1752). | |
| 54 | + * - `X-WCPOS-Client` — client platform signal (wcpos/woocommerce-pos#1752). | |
| 47 | 55 | * |
| 48 | 56 | * @return string[] Header names in their canonical (sent) casing. |
| 49 | 57 | */ |
| 50 | 58 | public static function headers(): array { |
| @@ -53,8 +61,10 @@ | ||
| 53 | 61 | array( |
| 54 | 62 | 'If-None-Match', |
| 55 | 63 | 'X-WCPOS-Idempotency-Key', |
| 56 | 64 | Store_Scope::HEADER, |
| 65 | + 'X-WCPOS-Protocol', | |
| 66 | + 'X-WCPOS-Client', | |
| 57 | 67 | ) |
| 58 | 68 | ); |
| 59 | 69 | } |
| 60 | 70 | |
