From 718251c67c876352a5dfca7592613e33f6713061 Mon Sep 17 00:00:00 2001
From: Dries Augustyns <inbox@driaug.com>
Date: Wed, 7 Jan 2026 13:11:54 +0100
Subject: [PATCH] fix: Enhance CORS handling to allow requests with rejection
 logging

---
 apps/api/src/app.ts | 34 +++++++++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/apps/api/src/app.ts b/apps/api/src/app.ts
index 55408e5..6bc2a37 100644
--- a/apps/api/src/app.ts
+++ b/apps/api/src/app.ts
@@ -87,9 +87,41 @@ const server = new (class extends Server {
         ? [/.*\.localhost:1000/, 'http://localhost:3000', 'http://localhost:4000']
         : [DASHBOARD_URI, LANDING_URI, WIKI_URI];
 
+    // Log CORS configuration on startup
+    signale.info('CORS configuration', {
+      environment: NODE_ENV,
+      allowedOrigins: allowedOrigins.map(o => (o instanceof RegExp ? o.toString() : o)),
+    });
+
     this.app.use(
       cors({
-        origin: allowedOrigins,
+        origin: (origin, callback) => {
+          // Allow requests with no origin (e.g., mobile apps, curl, server-to-server)
+          if (!origin) {
+            return callback(null, true);
+          }
+
+          // Check if origin matches any allowed origin (string or regex)
+          const isAllowed = allowedOrigins.some(allowed => {
+            if (allowed instanceof RegExp) {
+              return allowed.test(origin);
+            }
+            return allowed === origin;
+          });
+
+          if (isAllowed) {
+            callback(null, true);
+          } else {
+            // Log CORS rejection with helpful information
+            signale.warn('CORS request rejected', {
+              origin,
+              allowedOrigins: allowedOrigins.map(o => (o instanceof RegExp ? o.toString() : o)),
+              hint: 'If using HTTPS, ensure USE_HTTPS=true is set in your environment variables',
+            });
+            // Reject the CORS request by passing false (don't send CORS headers)
+            callback(null, false);
+          }
+        },
         credentials: true,
       }),
     );