fix(wpt): serve the XHR CORS echo fixture

Match the upstream corsenabled.py response headers, request metadata reflection, query-controlled delay and additional Content-Type allowance. Recognize exact relative and absolute fixture references during XHR case selection.

Validation: all 545 Python tests pass, including six new fixture tests. With an unchanged engine binary, nine CORS WPT cases improve from 1 to 6 passing and subtests from 14 to 36 of 44, with no regressions.

moli-benchmark/moli_benchmark/wpt_cross/case_set.py

@@ -820,7 +820,7 @@ def _xhr_handler_reference_patterns(directory: str) -> tuple[re.Pattern[str], ..
     references = []
     for name in (
         "requri.py", "redirect.py", "inspect-headers.py", "echo-headers.py", "content.py",
-        "echo-content-type.py", "win-1252-xml.py", "win-1252-html.py",
+        "echo-content-type.py", "corsenabled.py", "win-1252-xml.py", "win-1252-html.py",
         "invalid-utf8-html.py", "shift-jis-html.py", "img-utf8-html.py",
         "empty-div-utf8-html.py", "status.py", "last-modified.py",
     ):

moli-benchmark/moli_benchmark/wpt_cross/server.py

@@ -118,6 +118,7 @@ XHR_RESOURCE_PATHS = {
     "/xhr/resources/inspect-headers.py",
     "/xhr/resources/echo-headers.py",
     "/xhr/resources/content.py",
+    "/xhr/resources/corsenabled.py",
     "/xhr/resources/echo-content-type.py",
     "/xhr/resources/status.py",
     "/xhr/resources/last-modified.py",
@@ -2955,6 +2956,33 @@ def _make_handler(
                     headers = [("Content-Type", "text/plain")]
                     # wptserve exposes the same HTTPMessage as raw_headers.
                     body = str(self.headers).encode("utf-8")
+                elif path == "/xhr/resources/corsenabled.py":
+                    params = parse_qs(parsed.query, keep_blank_values=True, encoding="latin-1")
+                    if "delay" in params:
+                        time.sleep(int(params["delay"][0]))
+                    request_body = self._read_content_length_request_body()
+                    if request_body is None:
+                        return True
+                    upload_consumed = True
+                    status, reason, body = 200, None, b"Test"
+                    headers = [
+                        ("Access-Control-Allow-Origin", "*"),
+                        ("Access-Control-Allow-Credentials", "true"),
+                        ("Access-Control-Allow-Methods", "GET, POST, PUT, FOO"),
+                        ("Access-Control-Allow-Headers", "x-test, x-foo"),
+                        ("Access-Control-Expose-Headers",
+                         "x-request-method, x-request-content-type, x-request-query, "
+                         "x-request-content-length, x-request-data"),
+                    ]
+                    if "safelist_content_type" in params:
+                        headers.append(("Access-Control-Allow-Headers", "content-type"))
+                    headers.extend([
+                        ("X-Request-Method", self.command),
+                        ("X-Request-Query", parsed.query or "NO"),
+                        ("X-Request-Content-Length", self.headers.get("Content-Length", "NO")),
+                        ("X-Request-Content-Type", self.headers.get("Content-Type", "NO")),
+                        ("X-Request-Data", request_body.decode("latin-1")),
+                    ])
                 elif path == "/xhr/resources/content.py":
                     params = parse_qs(parsed.query, keep_blank_values=True, encoding="latin-1")
                     if "content" in params: