Send SDK version as X-SDK-Version header

Move the cookie-banner SDK version from the POST consents
request body to a custom X-SDK-Version header sent on every
API call. The server now reads it from the header and the
CORS middleware allows it through preflight.

Signed-off-by: Émile Ré <emile@getprobo.com>

packages/cookie-banner/src/client.ts

@@ -288,7 +288,6 @@ export class CookieBannerClient {
       version: cfg.version,
       action,
       consent_data: consentData,
-      sdk_version: __SDK_VERSION__,
     };
     void fetchJSON<ConsentRecord>(url, { method: "POST", body })
       .then(() => void flush(this.bannerId))

packages/cookie-banner/src/http.ts

@@ -120,6 +120,7 @@ export async function fetchJSON<T>(
     credentials: "omit",
     headers: {
       Accept: "application/json",
+      "X-SDK-Version": __SDK_VERSION__,
       ...(body !== undefined && { "Content-Type": "application/json" }),
       ...headers,
     },

pkg/server/api/cookiebanner/v1/cors_middleware.go

@@ -66,7 +66,7 @@ func newCORSMiddleware(logger *log.Logger, cookieBannerSvc *cookiebanner.Service
 
 				w.Header().Set("Access-Control-Allow-Origin", origin)
 				w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
-				w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
+				w.Header().Set("Access-Control-Allow-Headers", "Content-Type, X-SDK-Version")
 				w.Header().Set("Access-Control-Max-Age", "600")
 				w.Header().Set("Vary", "Origin")
 

pkg/server/api/cookiebanner/v1/handler.go

@@ -122,7 +122,6 @@ type (
 		Version     int                          `json:"version"`
 		Action      coredata.CookieConsentAction `json:"action"`
 		ConsentData json.RawMessage              `json:"consent_data"`
-		SdkVersion  string                       `json:"sdk_version"`
 	}
 
 	postConsentResponse struct {
@@ -148,6 +147,7 @@ func (h *Handler) handlePostConsent(w http.ResponseWriter, r *http.Request) {
 
 	ip := clientip.Extract(r)
 	ua := r.UserAgent()
+	sdkVersion := r.Header.Get("X-SDK-Version")
 
 	req := cookiebanner.RecordConsentRequest{
 		Version:     body.Version,
@@ -156,7 +156,7 @@ func (h *Handler) handlePostConsent(w http.ResponseWriter, r *http.Request) {
 		UserAgent:   &ua,
 		ConsentData: body.ConsentData,
 		Action:      body.Action,
-		SdkVersion:  body.SdkVersion,
+		SdkVersion:  sdkVersion,
 	}
 
 	record, err := h.cookieBannerSvc.RecordConsent(r.Context(), bannerID, req)