From 2b8915bd601c8c77d8a0bbd983b989daf73a5bbe Mon Sep 17 00:00:00 2001
From: Will Anderson <will.anderson@neurontechnologies.ai>
Date: Mon, 11 May 2026 12:15:18 -0500
Subject: [PATCH] Fix JS syntax errors and stage supabase-config CORS in CI

chat-widget.el: apostrophe in El native_js double-quoted strings caused
the El compiler to drop the backslash, producing broken JS single-quoted
strings. Switched those four string literals to double-quoted JS strings
using \" escaping so the compiled output is valid.

main.el: /api/supabase-config was returning 403 for all stage Cloud Run
origins. Added marketing-stage-* prefix to the allowed list so the
checkout page can initialise Supabase during CI E2E runs.
---
 src/js/chat-widget.el | 8 ++++----
 src/main.el           | 1 +
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/js/chat-widget.el b/src/js/chat-widget.el
index 64101fc..a1c1c46 100644
--- a/src/js/chat-widget.el
+++ b/src/js/chat-widget.el
@@ -295,11 +295,11 @@ fn main() -> Void {
         session.messages.push({ role: 'ai', text: reply });
         saveSession(session);
       } else {
-        addMsg('ai', 'Hey. What\'s on your mind?', true);
+        addMsg('ai', \"Hey. What's on your mind?\", true);
       }
     })
     .catch(function() {
-      addMsg('ai', 'Hey. What\'s on your mind?', true);
+      addMsg('ai', \"Hey. What's on your mind?\", true);
     });
   }
 
@@ -532,7 +532,7 @@ fn main() -> Void {
           var ss   = secsLeft % 60;
           var pad  = function(n) { return n < 10 ? '0' + n : '' + n; };
           var ts   = hh > 0 ? (hh + ':' + pad(mm) + ':' + pad(ss)) : (pad(mm) + ':' + pad(ss));
-          return 'You\'ve had 10 conversations today. Come back in ' + ts + '.';
+          return \"You've had 10 conversations today. Come back in \" + ts + \".\";
         };
         addMsg('ai', _showRateTimer());
         // Update the last ai message with a live ticker
@@ -544,7 +544,7 @@ fn main() -> Void {
           if (lastAi) { lastAi.textContent = _showRateTimer(); }
           if (Math.floor(Date.now() / 1000) >= d.reset_at) {
             clearInterval(_timerInterval);
-            if (lastAi) { lastAi.textContent = 'You\'re all set — conversations reset. Say hello!'; }
+            if (lastAi) { lastAi.textContent = \"You're all set — conversations reset. Say hello!\"; }
             if (input)  { input.disabled = false; input.placeholder = 'Ask me anything...'; }
             if (btn)    { btn.disabled = false; }
           }
diff --git a/src/main.el b/src/main.el
index eadcd47..6fe4feb 100644
--- a/src/main.el
+++ b/src/main.el
@@ -1172,6 +1172,7 @@ fn handle_request_inner(method: String, path: String, headers: Map, body: String
             || str_eq(req_origin, "https://www.neurontechnologies.ai")
             || str_starts_with(req_origin, "http://localhost:")
             || str_starts_with(req_origin, "http://127.0.0.1:")
+            || str_starts_with(req_origin, "https://marketing-stage-")
         if !origin_ok {
             return "{\"__status__\":403,\"error\":\"forbidden\"}"
         }