a67fc0767e
The order-action / order-block UI extensions are hosted on extensions.shopifycdn.com and call our app via fetch(). Without CORS headers the browser blocked the response. authenticate.admin already returns a cors helper and handles OPTIONS preflight - wrap every Response with it.