CORS support in login v2 and OAuth2 flow

Context

I have created a NextCloud app which adds a file menu item in Files app. When you click this menu item, it opens our website. From this website, I want to login into NextCloud so that I can get credentials which I can use to download and upload files.

First step I did was using the hardcoded username:password and passed it in Authorization header to download and upload URLs which failed on CORS. I was able to resolve the CORS issues once I installed WebAppPassword and whitelisted my website.

As a second step, I replaced the hardcoded username:password with the login v2 flow and it failed on CORS. This was surprising as my website origin was already whitelisted in WebAppPassword and was working for download and upload URLs. As a temporary hack, I added @CORS annotation in the login v2 controllers and it worked on all URLs except login/v2/poll because it fails on preflight request as it's a POST call with json content type. To solve this, another temporary hack I did was to add preflight URL for login v2 flow.

As a third step, I tried the OAuth2 flow. Similar to second step, I faced CORS and preflight issues. As a temporary hack I added @CORS in apps/oauth2/lib/Controller/OauthApiController.php methods and added preflight URL route.

Problem

As these hacks were direct code changes in the NextCloud server code, I want to replace these hacks with a proper solution. Things I tried:

1. In my NextCloud app, I registered a Middleware to resolve the CORS issues. The problem is that the Middleware works only the URLs pointed to the app I wrote and it doesn't work on the login URLs. Even if it works somehow, it will not resolve the preflight issue as the preflight route is not present.

Feature request

1. Ask: Generic solution for CORS for NextCloud app developer

As a NextCloud app developer, we can't make changes in the NextCloud server. So what's the generic solution for NextCloud app developers to resolve CORS and preflight issues?

2. Ask: Update login flow documentation

As a NextCloud app developer, we rely on login flow documentations(Login v2, OAuth) which doesn't talk about CORS issues and how to resolve. This ask is to update the login flow documentation to cover such issues and ways to resolve them.

3. Ask: Extend WebAppPassword for login URLs

As WebAppPassword works for download and upload URLs, can you extend the WebAppPassword support for login flows (both login v2 and OAuth) as well?

Start by reviewing the login v2 flow documentation and the OAuth documentation, then inspect the login v2 controllers and apps/oauth2/lib/Controller/OauthApiController.php. Clarify how CORS and POST preflight should work for login v2 and OAuth, including WebAppPassword support. Done means the supported solution is implemented or documented without direct server hacks.