ccweb-add-on-scripts start command cloud provide custom HTTP header config param?

[slightc]

Expected Behaviour

ccweb-add-on-scripts start command cloud config Cross-Origin-Embedder-Policy header or custom HTTP header, because I'm need test app for enabled COEP, only cloud modify inversify.config for it, cloud provide some config param for that?

Actual Behaviour

ccweb-add-on-scripts start can't add custom HTTP header

Reproduce Scenario (including but not limited to)

not need

Steps to Reproduce

not need

Platform and Version

@adobe/ccweb-add-on-scripts/1.0.0 darwin-arm64 node-v18.17.0

Sample Code that illustrates the problem

not need

Logs taken while reproducing problem

not need

[xerxovksi]

We want to be aligned with the COEP header set in Adobe Express to ensure that the add-on can be sideloaded inside Adobe Express.
And about accepting other custom headers in ccweb-add-on-scripts start command, what is the use case here? Given that add-ons are meant to run only inside Adobe Express, the ccweb-add-on-scripts start command adds all the required headers that are required for sideloading the add-on inside Adobe Express.

[slightc]

The value of the Cross-Origin-Embedder-Policy (COEP) header for add-on resources is set to credentialless, but you should be aware that it will be changing to use require-corp sometime in the future, so you should plan for that by ensuring resources loaded from within the document have CORP / CORS enabled.
https://developer.adobe.com/express/add-ons/docs/guides/develop/context/#cors--coep-handling

Yes, at present, COEP value credentialless is align to Adobe Express, but in add-on review need test for COEP require-corp, so I want change it by start command params.

Accepting other custom headers also for this case.

[xerxovksi]

Ok, so you need this feature for reviewing add-ons. Since your use case in unique to only reviewers, I'm thinking if we should create a separate ccweb-add-on-review-scripts package with such additional options. And letting the ccweb-add-on-scripts be targetted only to add-on developers. @kerrishotts what do you think?