From 636b0280c7afb093d61ae73d956059cd5c89ddbc Mon Sep 17 00:00:00 2001
From: phoenix <kundeng00@pm.me>
Date: Sun, 21 Dec 2025 00:28:08 +0000
Subject: [PATCH] tsk-10: CORS support (#28)

Closes #10

Reviewed-on: https://git.kundeng.us/phoenix/textsender-auth/pulls/28
Co-authored-by: phoenix <kundeng00@pm.me>
Co-committed-by: phoenix <kundeng00@pm.me>
---
 .env.docker.sample             |  1 +
 .env.sample                    |  1 +
 .gitea/workflows/workflow.yaml |  1 +
 cmd/api/main.go                |  2 +-
 internal/config/config.go      | 28 +++++++++++++++++++++++-----
 5 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/.env.docker.sample b/.env.docker.sample
index a795df2..7fce7cd 100644
--- a/.env.docker.sample
+++ b/.env.docker.sample
@@ -6,3 +6,4 @@ DB_HOST=auth_db
 DB_PORT=5432
 DB_SSLMODE=disable
 ENABLE_REGISTRATION=true
+ALLOWED_ORIGINS="http://textsender.com"
diff --git a/.env.sample b/.env.sample
index 4574f22..dc73a18 100644
--- a/.env.sample
+++ b/.env.sample
@@ -6,3 +6,4 @@ DB_HOST=localhost
 DB_PORT=5432
 DB_SSLMODE=disable
 ENABLE_REGISTRATION=true
+ALLOWED_ORIGINS="http://textsender.com"
diff --git a/.gitea/workflows/workflow.yaml b/.gitea/workflows/workflow.yaml
index 80d1c9b..1b5f0c3 100644
--- a/.gitea/workflows/workflow.yaml
+++ b/.gitea/workflows/workflow.yaml
@@ -107,6 +107,7 @@ jobs:
           echo "DB_PORT=$DB_PORT" >> .env
           echo "DB_SSLMODE=$DB_SSLMODE" >> .env
           echo "ENABLE_REGISTRATION=true" >> .env
+          echo "ALLOWED_ORIGINS=http://localhost:9080" >> .env
 
           echo "Initializing config"
           mkdir -p ~/.ssh
diff --git a/cmd/api/main.go b/cmd/api/main.go
index 8430d1d..b5e70f3 100644
--- a/cmd/api/main.go
+++ b/cmd/api/main.go
@@ -85,7 +85,7 @@ func main() {
 
 	// Configure CORS
 	router.Use(cors.Handler(cors.Options{
-		AllowedOrigins:   []string{fmt.Sprintf("http://localhost:%s", config.Port), "http://localhost:5173", "https://textsender.com"},
+		AllowedOrigins:   cfg.AllowedOrigins,
 		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"},
 		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
 		ExposedHeaders:   []string{"Link", "X-Total-Count"},
diff --git a/internal/config/config.go b/internal/config/config.go
index e292820..74ec025 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -19,6 +19,7 @@ type Config struct {
 	ServerPort         string
 	ResetDB            bool
 	EnableRegistration bool
+	AllowedOrigins     []string
 }
 
 type ConnectionInfo struct {
@@ -67,12 +68,23 @@ func Load() *Config {
 
 	unpackedConnString := UnpackDBConnString()
 	dbConnString := unpackedConnString.Parse()
+	allowedOrigins := unpackAllowedOrigin()
 
-	return &Config{
-		DBConnString:       dbConnString,
-		ServerPort:         *port,
-		ResetDB:            *resetDb,
-		EnableRegistration: CheckRegistration(),
+	if len(allowedOrigins) > 0 {
+		return &Config{
+			DBConnString:       dbConnString,
+			ServerPort:         *port,
+			ResetDB:            *resetDb,
+			EnableRegistration: CheckRegistration(),
+			AllowedOrigins:     allowedOrigins,
+		}
+	} else {
+		return &Config{
+			DBConnString:       dbConnString,
+			ServerPort:         *port,
+			ResetDB:            *resetDb,
+			EnableRegistration: CheckRegistration(),
+		}
 	}
 }
 
@@ -131,6 +143,12 @@ func UnpackDBConnString() (connInfo ConnectionInfo) {
 	return
 }
 
+func unpackAllowedOrigin() []string {
+	allowedOriginsRaw := os.Getenv("ALLOWED_ORIGINS")
+	allowedOriginsSplit := strings.Split(allowedOriginsRaw, ",")
+	return allowedOriginsSplit
+}
+
 func CheckRegistration() bool {
 	if flagValue := os.Getenv("ENABLE_REGISTRATION"); flagValue != "" {
 		if val := strings.ToUpper(flagValue); val == "TRUE" {