test patch cors

backend/tests/Feature/CorsTest.php

@@ -21,4 +21,23 @@ class CorsTest extends TestCase
         );
         $response->assertHeader('Access-Control-Allow-Credentials', 'true');
     }
+
+    public function testAllowsPatchPreflight(): void
+    {
+        $response = $this->withHeaders([
+            'Origin' => 'http://localhost:5173',
+            'Access-Control-Request-Method' => 'PATCH',
+            'Access-Control-Request-Headers' => 'content-type',
+        ])->options('/api/elements/1');
+
+        $response->assertNoContent();
+        $response->assertHeader(
+            'Access-Control-Allow-Origin',
+            'http://localhost:5173'
+        );
+        $this->assertStringContainsString(
+            'PATCH',
+            $response->headers->get('Access-Control-Allow-Methods')
+        );
+    }
 }