From eb3b7338523db0d9673f426eabe2f7f930c6ceb9 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Sat, 20 Jun 2026 00:00:18 -0400
Subject: [PATCH] seedance cors (#1671)

---
 .../lib/actix_cors_configs/src/configs/mod.rs |  1 +
 .../src/configs/realseedance.rs               | 14 +++++++++++
 crates/lib/actix_cors_configs/src/cors.rs     | 25 +++++++++++++++++++
 3 files changed, 40 insertions(+)
 create mode 100644 crates/lib/actix_cors_configs/src/configs/realseedance.rs

diff --git a/crates/lib/actix_cors_configs/src/configs/mod.rs b/crates/lib/actix_cors_configs/src/configs/mod.rs
index 520a7c47e2..5506579825 100644
--- a/crates/lib/actix_cors_configs/src/configs/mod.rs
+++ b/crates/lib/actix_cors_configs/src/configs/mod.rs
@@ -6,6 +6,7 @@ pub (crate) mod artcraft_website;
 pub (crate) mod development_only;
 pub (crate) mod fakeyou;
 pub (crate) mod legacy;
+pub (crate) mod realseedance;
 pub (crate) mod storyteller;
 pub (crate) mod storyteller_board;
 pub (crate) mod storyteller_render;
diff --git a/crates/lib/actix_cors_configs/src/configs/realseedance.rs b/crates/lib/actix_cors_configs/src/configs/realseedance.rs
new file mode 100644
index 0000000000..eb17f386c0
--- /dev/null
+++ b/crates/lib/actix_cors_configs/src/configs/realseedance.rs
@@ -0,0 +1,14 @@
+use actix_cors::Cors;
+use crate::util::netlify_branch_domain_matches::netlify_branch_domain_matches;
+
+/// CORS for the "Is That Real Seedance?" website (video-info-website).
+pub fn add_realseedance(cors: Cors, _is_production: bool) -> Cors {
+  cors
+      // Actual domain
+      .allowed_origin("https://realseedance.com")
+      .allowed_origin("https://www.realseedance.com")
+      // Netlify project (bare domain + branch / deploy-preview subdomains)
+      .allowed_origin_fn(|origin, _req_head| {
+        netlify_branch_domain_matches(origin, "real-seedance.netlify.app")
+      })
+}
diff --git a/crates/lib/actix_cors_configs/src/cors.rs b/crates/lib/actix_cors_configs/src/cors.rs
index 59c3fb9e7e..7a0be125bb 100644
--- a/crates/lib/actix_cors_configs/src/cors.rs
+++ b/crates/lib/actix_cors_configs/src/cors.rs
@@ -9,6 +9,7 @@ use crate::configs::artcraft_website::add_artcraft_website;
 use crate::configs::development_only::add_development_only;
 use crate::configs::fakeyou::{add_fakeyou, add_fakeyou_dev_proxy};
 use crate::configs::legacy::{add_legacy_storyteller_stream, add_legacy_trumped, add_legacy_vocodes, add_power_stream};
+use crate::configs::realseedance::add_realseedance;
 use crate::configs::storyteller::{add_storyteller, add_storyteller_dev_proxy};
 use crate::configs::storyteller_board::add_storyteller_board;
 use crate::configs::storyteller_render::add_storyteller_render;
@@ -52,6 +53,7 @@ fn do_build_cors_config(is_production: bool) -> Cors {
   cors = add_artcraft_webapp(cors, is_production);
   cors = add_artcraft_website(cors, is_production);
   cors = add_artcraft_admin_dashboard(cors, is_production);
+  cors = add_realseedance(cors, is_production);
 
   // Legacy
   cors = add_legacy_trumped(cors, is_production);
@@ -117,6 +119,9 @@ mod tests {
       "https://artcraft.ai",
       "https://www.artcraft.ai",
       "https://artcraft-dashboard.netlify.app",
+      "https://realseedance.com",
+      "https://www.realseedance.com",
+      "https://real-seedance.netlify.app",
     ];
     for origin in origins {
       assert_origin_ok(&production_cors, origin).await;
@@ -181,6 +186,26 @@ mod tests {
     assert_origin_invalid(&development_cors, "https://staging.fakeyou.com").await;
   }
 
+  #[actix_rt::test]
+  async fn test_realseedance_production() {
+    let production_cors = build_cors_config(ServerEnvironment::Production);
+
+    // Valid origins
+    assert_origin_ok(&production_cors, "https://realseedance.com").await;
+    assert_origin_ok(&production_cors, "https://www.realseedance.com").await;
+    assert_origin_ok(&production_cors, "https://real-seedance.netlify.app").await;
+    // Netlify deploy-preview / branch subdomain
+    assert_origin_ok(
+      &production_cors,
+      "https://deploy-preview-12--real-seedance.netlify.app",
+    )
+    .await;
+
+    // Invalid origins
+    assert_origin_invalid(&production_cors, "https://realseedance.fake.com").await;
+    assert_origin_invalid(&production_cors, "https://realseedance.netlify.app").await;
+  }
+
   #[actix_rt::test]
   async fn test_storyteller_production() {
     let production_cors = build_cors_config(ServerEnvironment::Production);