Added headers if making a preview site request (#19668)

no issue

- to test if we can access Private Sites in Admin when set as a private
site.
- the issue is, we have CORS issues that doesn't allow a cookie to be
passed via Admin when the site uses a custom domain.
- generally does not affect self hosters.

ghost/core/core/frontend/services/theme-engine/middleware/update-local-template-options.js

@@ -15,6 +15,13 @@ function updateLocalTemplateOptions(req, res, next) {
     // @TODO: it would be nicer if this was proper middleware somehow...
     const previewData = preview.handle(req, Object.keys(customThemeSettingsCache.getAll()));
 
+    // @WIP to check if we can access private sites via cookies in Settings.. but abit hacky
+    if (req && req.headers && req.headers['x-ghost-preview']) {
+        res.setHeader('Access-Control-Allow-Origin', siteData.url); // Specify the allowed origin or handle dynamically
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST'); // Include POST in the allowed methods
+        res.setHeader('Access-Control-Allow-Credentials', 'true'); // Allow credentials including cookies
+    }
+
     // strip custom off of preview data so it doesn't get merged into @site
     const customData = previewData.custom;
     delete previewData.custom;