Express example does not handle CORS preflight for cross-origin deployments

[Quitoboss]

Hi, thanks for the project.

I ran into a problem while integrating ChatCops with this setup:

• Website origin: https://subdomain.example.com
• API origin: https://apis.example.com
• Widget package: @chatcops/widget@0.3.0
• Server package: @chatcops/server
• Runtime: Node.js on Plesk / Express

I started from the Express example pattern shown in the docs / examples:

app.post('/chat', chatcopsMiddleware({...}))

Actual behavior

The widget rendered correctly, but sending a message failed from the browser with a CORS error on the preflight request:

Access to fetch at https://apis.example.com/chat from origin https://subdomain.example.com has been blocked by CORS policy:
Response to preflight request doesn't pass access control check:
No 'Access-Control-Allow-Origin' header is present on the requested resource.

In the widget UI this showed up as:
Connection error. Please check your network.

Expected behavior

The Express example should either:

• work in a cross-origin setup out of the box, or
• document that OPTIONS preflight requests must also be handled.

Reproduction

1. Serve the website and API from different origins/subdomains.
2. Configure the widget to call the Express /chat endpoint.
3. Use the Express example with:
   app.post('/chat', chatcopsMiddleware({...}))
4. Use the Express example with:

Workaround

Changing the route to this fixed the issue:

const chatHandler = chatcopsMiddleware({...});
app.all('/chat', chatHandler);

So the likely issue is that the preflight OPTIONS request does not reach the middleware when using app.post(...).

It may help to update either:

the Express example in packages/server/src/examples/express-server.ts
or the documentation for cross-origin deployments
or both
Thanks and best regards from Spain