nandi.uk / semble
This repository has no description
0
Fork 0

Configure Feed

Select the types of activity you want to include in your feed.

Merge branch 'feature/semble-xrpc-api-20260512' into development

author
Wesley Finck date (May 13, 2026, 9:52 PM -0700) commit f989347c parent a9e3d0df
+43 -8
+43 -8
src/shared/infrastructure/http/app.ts
··· 1 - import express, { Express } from 'express'; 1 + import express, { Express, Request, Response, NextFunction } from 'express'; 2 2 import cors from 'cors'; 3 3 import cookieParser from 'cookie-parser'; 4 4 import { Router } from 'express'; ··· 50 50 } 51 51 }; 52 52 53 - app.use( 54 - cors({ 55 - origin: getAllowedOrigins(), 56 - methods: ['GET', 'POST', 'PUT', 'DELETE'], 57 - credentials: true, // Required for cookies to work in cross-origin requests 58 - }), 59 - ); 53 + const environment = configService.get().environment; 54 + const allowedOrigins = getAllowedOrigins(); 55 + const allowedMethods = ['GET', 'POST', 'PUT', 'DELETE']; 56 + 57 + if (environment === Environment.PROD) { 58 + app.use( 59 + cors({ 60 + origin: allowedOrigins, 61 + methods: allowedMethods, 62 + credentials: true, // Required for cookies to work in cross-origin requests 63 + }), 64 + ); 65 + } else { 66 + // DEV/LOCAL: allow credentialed CORS for known origins, open CORS for everyone else. 67 + // Non-allowed origins get '*' which browsers refuse to use with credentials — 68 + // so cookie-auth endpoints naturally fail for them, while read-only endpoints work. 69 + const allowedOriginsSet = new Set(allowedOrigins); 70 + app.use((req: Request, res: Response, next: NextFunction) => { 71 + const origin = req.headers.origin; 72 + 73 + if (typeof origin === 'string' && allowedOriginsSet.has(origin)) { 74 + res.setHeader('Access-Control-Allow-Origin', origin); 75 + res.setHeader('Access-Control-Allow-Credentials', 'true'); 76 + res.setHeader('Vary', 'Origin'); 77 + } else { 78 + res.setHeader('Access-Control-Allow-Origin', '*'); 79 + } 80 + 81 + res.setHeader('Access-Control-Allow-Methods', allowedMethods.join(',')); 82 + res.setHeader( 83 + 'Access-Control-Allow-Headers', 84 + 'Content-Type,Authorization', 85 + ); 86 + 87 + if (req.method === 'OPTIONS') { 88 + res.status(204).end(); 89 + return; 90 + } 91 + 92 + next(); 93 + }); 94 + } 60 95 61 96 // Middleware setup 62 97 app.use(cookieParser()); // Parse cookies from incoming requests