Merge branch 'stable-3.9' into stable-3.10

* stable-3.9:
  web-dev-server: serve some missing static assets
  web-dev-server: set content type for gr-app.js
  web-dev-server: fix cors not being set

I2d88dbcecf4b2011aa0a1d7304e3fafe88c2daf5 updated @koa/cors to 3.4.3, as
noted in Ia2850e7fd88b4a20acfa6344469db69dafe6cb25, that version rolled
back the fix to get cors headers set.

Release-Notes: skip
Change-Id: Ief8ada64834056c6d0affd74c944164f2f8d536a
diff --git a/package.json b/package.json
index 72e75b7..1b91658 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
     "@typescript-eslint/parser": "^5.62.0"
   },
   "devDependencies": {
-    "@koa/cors": "^3.4.3",
+    "@koa/cors": "^5.0.0",
     "@types/page": "^1.11.9",
     "@typescript-eslint/eslint-plugin": "^5.62.0",
     "@web/dev-server": "^0.1.38",
diff --git a/web-dev-server.config.mjs b/web-dev-server.config.mjs
index 2a7dca4..53a240e 100644
--- a/web-dev-server.config.mjs
+++ b/web-dev-server.config.mjs
@@ -1,5 +1,7 @@
 import { esbuildPlugin } from "@web/dev-server-esbuild";
 import cors from "@koa/cors";
+import path from 'node:path';
+import fs from 'node:fs';
 
 /** @type {import('@web/dev-server').DevServerConfig} */
 export default {
@@ -18,6 +20,20 @@
     // (ex: gerrit-review.googlesource.com), which happens during local
     // development with Gerrit FE Helper extension.
     cors({ origin: "*" }),
+    // Map some static assets.
+    // When creating the bundle, the files are moved by polygerrit_bundle() in
+    // polygerrit-ui/app/rules.bzl
+    async (context, next) => {
+
+      if ( context.url.includes("/bower_components/webcomponentsjs/webcomponents-lite.js") ) {
+        context.response.redirect("/node_modules/@webcomponents/webcomponentsjs/webcomponents-lite.js");
+
+      } else if ( context.url.startsWith( "/fonts/" ) ) {
+        const fontFile = path.join( "lib/fonts", path.basename(context.url) );
+        context.body = fs.createReadStream( fontFile );
+      }
+      await next();
+    },
     // The issue solved here is that our production index.html does not load
     // 'gr-app.js' as an ESM module due to our build process, but in development
     // all our source code is written as ESM modules. When using the Gerrit FE
@@ -40,6 +56,7 @@
       await next();
 
       if (!isGrAppMjs && context.url.includes("gr-app.js")) {
+        context.set('Content-Type', 'application/javascript; charset=utf-8');
         context.body = "import('./gr-app.mjs')";
       }
     },
diff --git a/yarn.lock b/yarn.lock
index 9a3503c..7b49a65 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -252,10 +252,10 @@
   resolved "https://registry.yarnpkg.com/@humanwhocodes/object-schema/-/object-schema-2.0.3.tgz#4a2868d75d6d6963e423bcf90b7fd1be343409d3"
   integrity sha512-93zYdMES/c1D69yZiKDBj0V24vqNzB/koF26KPaagAfd3P/4gUlh3Dys5ogAK+Exi9QyzlD8x/08Zt7wIKcDcA==
 
-"@koa/cors@^3.4.3":
-  version "3.4.3"
-  resolved "https://registry.yarnpkg.com/@koa/cors/-/cors-3.4.3.tgz#d669ee6e8d6e4f0ec4a7a7b0a17e7a3ed3752ebb"
-  integrity sha512-WPXQUaAeAMVaLTEFpoq3T2O1C+FstkjJnDQqy95Ck1UdILajsRhu6mhJ8H2f4NFPRBoCNN+qywTJfq/gGki5mw==
+"@koa/cors@^5.0.0":
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/@koa/cors/-/cors-5.0.0.tgz#0029b5f057fa0d0ae0e37dd2c89ece315a0daffd"
+  integrity sha512-x/iUDjcS90W69PryLDIMgFyV21YLTnG9zOpPXS7Bkt2b8AsY3zZsIpOLBkYr9fBcF3HbkKaER5hOBZLfpLgYNw==
   dependencies:
     vary "^1.1.2"