cors fix

backend/app/config.py

@@ -1,3 +1,4 @@
+from pydantic import computed_field
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -6,6 +7,8 @@ class Settings(BaseSettings):
     environment: str = "development"
     database_url: str = "postgresql+psycopg://urmi:urmi@localhost:5432/urmi"
     frontend_origin: str = "http://localhost:5173"
+    # Comma-separated browser origins for CORS (defaults to frontend_origin only)
+    cors_origins: str = ""
     auth_secret: str = "change-me-in-production"
     auth_cookie_secure: bool = False
     access_token_minutes: int = 60 * 24 * 7
@@ -34,5 +37,13 @@ class Settings(BaseSettings):
         extra="ignore",
     )
 
+    @computed_field  # type: ignore[prop-decorator]
+    @property
+    def cors_allowed_origins(self) -> list[str]:
+        configured = [item.strip() for item in self.cors_origins.split(",") if item.strip()]
+        if configured:
+            return configured
+        return [self.frontend_origin]
+
 
 settings = Settings()