fix live leaderbord details

tests/server_persistence.integration.test.js

@@ -74,6 +74,7 @@ test("SQLite API persists state, passings, and overlay session results", { timeo
       PORT: String(port),
       RC_TIMING_DATA_DIR: dataDir,
       RC_TIMING_PID_FILE: "",
+      RC_ALLOWED_ORIGINS: "https://trusted.example",
     },
     stdio: ["ignore", "pipe", "pipe"],
   });
@@ -87,6 +88,20 @@ test("SQLite API persists state, passings, and overlay session results", { timeo
     assert.equal(health.ok, true);
     assert.equal(health.dbPath, join(dataDir, "rc_timing.sqlite"));
 
+    const sameOriginResponse = await fetch(`${baseUrl}/api/health`, { headers: { Origin: baseUrl } });
+    assert.equal(sameOriginResponse.status, 200);
+    assert.equal(sameOriginResponse.headers.get("access-control-allow-origin"), baseUrl);
+
+    const allowedOriginResponse = await fetch(`${baseUrl}/api/health`, { headers: { Origin: "https://trusted.example" } });
+    assert.equal(allowedOriginResponse.status, 200);
+    assert.equal(allowedOriginResponse.headers.get("access-control-allow-origin"), "https://trusted.example");
+
+    const rejectedOriginResponse = await fetch(`${baseUrl}/api/ammc/start`, {
+      method: "POST",
+      headers: { Origin: "https://untrusted.example" },
+    });
+    assert.equal(rejectedOriginResponse.status, 403);
+
     const soundManifestResponse = await fetch(`${baseUrl}/race-sounds/sound_manifest.json`);
     const soundManifest = await soundManifestResponse.json();
     assert.equal(soundManifestResponse.status, 200);