feat: configure CORS allowed origins for production

.env.example

@@ -8,3 +8,4 @@ API_PORT=3100
 LOG_LEVEL=info
 CURSOR_COMMIT_INTERVAL=10
 POLL_INTERVAL_MS=5000
+ALLOWED_ORIGINS=http://localhost:3000,https://chainlearn.io

src/config.ts

@@ -52,6 +52,11 @@ const configSchema = z.object({
     .positive()
     .default(5000)
     .describe("Polling interval in milliseconds when no new ledgers"),
+
+  allowedOrigins: z
+    .string()
+    .default("http://localhost:3000")
+    .transform((val) => val.split(",").map((s) => s.trim())),
 });
 
 export type Config = z.infer<typeof configSchema>;
@@ -70,6 +75,7 @@ function loadConfig(): Config {
     logLevel: process.env.LOG_LEVEL,
     cursorCommitInterval: process.env.CURSOR_COMMIT_INTERVAL,
     pollIntervalMs: process.env.POLL_INTERVAL_MS,
+    allowedOrigins: process.env.ALLOWED_ORIGINS,
   };
 
   const result = configSchema.safeParse(raw);

src/index.ts

@@ -27,8 +27,9 @@ async function main(): Promise<void> {
   });
 
   await app.register(cors, {
-    origin: true,
+    origin: config.allowedOrigins,
     methods: ["GET"],
+    credentials: true,
   });
 
   await registerRoutes(app);