From e12c6b86596a1e410c91a18798ba316419512f45 Mon Sep 17 00:00:00 2001
From: DeFiVC <defivc1@email.com>
Date: Wed, 8 Jul 2026 20:43:16 +0100
Subject: [PATCH] feat: configure CORS allowed origins for production
 deployment

- Add allowedOrigins config with comma-separated env var support
- Replace permissive origin:true with configured origins
- Add ALLOWED_ORIGINS to .env.example
---
 .env.example  | 1 +
 src/config.ts | 6 ++++++
 src/index.ts  | 3 ++-
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index 0e93c7f..a51bd9b 100644
--- a/.env.example
+++ b/.env.example
@@ -8,3 +8,4 @@ API_PORT=3100
 LOG_LEVEL=info
 CURSOR_COMMIT_INTERVAL=10
 POLL_INTERVAL_MS=5000
+ALLOWED_ORIGINS=http://localhost:3000,https://chainlearn.io
diff --git a/src/config.ts b/src/config.ts
index c47362c..91bf001 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -52,6 +52,11 @@ const configSchema = z.object({
     .positive()
     .default(5000)
     .describe("Polling interval in milliseconds when no new ledgers"),
+
+  allowedOrigins: z
+    .string()
+    .default("http://localhost:3000")
+    .transform((val) => val.split(",").map((s) => s.trim())),
 });
 
 export type Config = z.infer<typeof configSchema>;
@@ -70,6 +75,7 @@ function loadConfig(): Config {
     logLevel: process.env.LOG_LEVEL,
     cursorCommitInterval: process.env.CURSOR_COMMIT_INTERVAL,
     pollIntervalMs: process.env.POLL_INTERVAL_MS,
+    allowedOrigins: process.env.ALLOWED_ORIGINS,
   };
 
   const result = configSchema.safeParse(raw);
diff --git a/src/index.ts b/src/index.ts
index 416cd51..fc99a84 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -27,8 +27,9 @@ async function main(): Promise<void> {
   });
 
   await app.register(cors, {
-    origin: true,
+    origin: config.allowedOrigins,
     methods: ["GET"],
+    credentials: true,
   });
 
   await registerRoutes(app);