From 0d42ff72d3593e71b96e84bf44d7fef632445f37 Mon Sep 17 00:00:00 2001
From: debu-2 <suyash.aiml@gmail.com>
Date: Fri, 2 Oct 2026 12:15:27 +0530
Subject: [PATCH] cors fix

---
 .env.example          |  3 +++
 backend/.env.example  |  1 +
 backend/app/config.py | 11 +++++++++++
 backend/app/main.py   |  2 +-
 docker-compose.yml    |  1 +
 5 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index 23d1fb5..287f2df 100644
--- a/.env.example
+++ b/.env.example
@@ -9,6 +9,8 @@ AUTH_SECRET=replace-with-at-least-32-random-characters
 AUTH_COOKIE_SECURE=false
 ENVIRONMENT=development
 FRONTEND_ORIGIN=http://localhost:5173
+# Optional comma-separated CORS origins (defaults to FRONTEND_ORIGIN)
+# CORS_ORIGINS=https://urmiai.com,http://urmiai.com,https://www.urmiai.com,http://www.urmiai.com
 VITE_API_URL=http://localhost:8000
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
@@ -18,6 +20,7 @@ GOOGLE_REDIRECT_URI=http://localhost:8000/api/v1/auth/google/callback
 # AUTH_COOKIE_SECURE=true
 # ENVIRONMENT=production
 # FRONTEND_ORIGIN=https://urmiai.com
+# CORS_ORIGINS=https://urmiai.com,http://urmiai.com,https://www.urmiai.com,http://www.urmiai.com
 # VITE_API_URL=https://api.urmiai.com
 # GOOGLE_REDIRECT_URI=https://api.urmiai.com/api/v1/auth/google/callback
 # VOICE_RELAY_PUBLIC_URL=wss://api.urmiai.com/api/v1/voice
diff --git a/backend/.env.example b/backend/.env.example
index 021d928..15d1684 100644
--- a/backend/.env.example
+++ b/backend/.env.example
@@ -13,6 +13,7 @@ DATABASE_URL=postgresql+psycopg://urmi:urmi@localhost:5433/urmi
 # Must match the browser origin serving the frontend (CORS + OAuth redirect target)
 FRONTEND_ORIGIN=http://localhost:5173
 # Production: FRONTEND_ORIGIN=https://urmiai.com
+# Production: CORS_ORIGINS=https://urmiai.com,http://urmiai.com,https://www.urmiai.com,http://www.urmiai.com
 
 # --- Auth / sessions ---
 # Required in production. Use at least 32 random characters.
diff --git a/backend/app/config.py b/backend/app/config.py
index 4570cdb..31f31a3 100644
--- a/backend/app/config.py
+++ b/backend/app/config.py
@@ -1,3 +1,4 @@
+from pydantic import computed_field
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -6,6 +7,8 @@ class Settings(BaseSettings):
     environment: str = "development"
     database_url: str = "postgresql+psycopg://urmi:urmi@localhost:5432/urmi"
     frontend_origin: str = "http://localhost:5173"
+    # Comma-separated browser origins for CORS (defaults to frontend_origin only)
+    cors_origins: str = ""
     auth_secret: str = "change-me-in-production"
     auth_cookie_secure: bool = False
     access_token_minutes: int = 60 * 24 * 7
@@ -34,5 +37,13 @@ class Settings(BaseSettings):
         extra="ignore",
     )
 
+    @computed_field  # type: ignore[prop-decorator]
+    @property
+    def cors_allowed_origins(self) -> list[str]:
+        configured = [item.strip() for item in self.cors_origins.split(",") if item.strip()]
+        if configured:
+            return configured
+        return [self.frontend_origin]
+
 
 settings = Settings()
diff --git a/backend/app/main.py b/backend/app/main.py
index af021d5..6bd036e 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -66,7 +66,7 @@ app = FastAPI(
 )
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=[settings.frontend_origin],
+    allow_origins=settings.cors_allowed_origins,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
diff --git a/docker-compose.yml b/docker-compose.yml
index eb7fc93..0682eb7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -28,6 +28,7 @@ services:
       REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}
       ENVIRONMENT: ${ENVIRONMENT:-development}
       FRONTEND_ORIGIN: ${FRONTEND_ORIGIN:-http://localhost:5173}
+      CORS_ORIGINS: ${CORS_ORIGINS:-}
       AUTH_SECRET: ${AUTH_SECRET:-urmi-local-development-secret-change-me}
       AUTH_COOKIE_SECURE: ${AUTH_COOKIE_SECURE:-false}
       GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}