fix: correct API URL pathname parsing and CORS methods in server.js

server.js

@@ -31,7 +31,7 @@ const MIME_TYPES = {
 const server = http.createServer((req, res) => {
   // CORS headers
   res.setHeader('Access-Control-Allow-Origin', '*');
-  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
   res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
 
   if (req.method === 'OPTIONS') {
@@ -40,8 +40,11 @@ const server = http.createServer((req, res) => {
     return;
   }
 
+  const parsedUrl = new URL(req.url, `http://${req.headers.host || 'localhost'}`);
+  const pathname = parsedUrl.pathname;
+
   // API Config GET
-  if (req.url === '/api/config' && req.method === 'GET') {
+  if (pathname === '/api/config' && req.method === 'GET') {
     res.writeHead(200, { 'Content-Type': 'application/json' });
     if (fs.existsSync(CONFIG_FILE)) {
       try {
@@ -57,7 +60,7 @@ const server = http.createServer((req, res) => {
   }
 
   // API Config POST
-  if (req.url === '/api/config' && req.method === 'POST') {
+  if (pathname === '/api/config' && req.method === 'POST') {
     let body = '';
     req.on('data', chunk => {
       body += chunk.toString();
@@ -85,7 +88,7 @@ const server = http.createServer((req, res) => {
     return [];
   };
 
-  if (req.url.startsWith('/api/categories')) {
+  if (pathname === '/api/categories') {
     if (req.method === 'GET') {
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify(readCategories()));
@@ -119,8 +122,7 @@ const server = http.createServer((req, res) => {
     }
 
     if (req.method === 'DELETE') {
-      const urlParams = new URL(req.url, `http://${req.headers.host}`);
-      const id = urlParams.searchParams.get('id');
+      const id = parsedUrl.searchParams.get('id');
       if (id) {
         let categories = readCategories();
         categories = categories.filter(c => c.id !== id);