cors fix

.env.example

@@ -9,6 +9,8 @@ AUTH_SECRET=replace-with-at-least-32-random-characters
 AUTH_COOKIE_SECURE=false
 ENVIRONMENT=development
 FRONTEND_ORIGIN=http://localhost:5173
+# Optional comma-separated CORS origins (defaults to FRONTEND_ORIGIN)
+# CORS_ORIGINS=https://urmiai.com,http://urmiai.com,https://www.urmiai.com,http://www.urmiai.com
 VITE_API_URL=http://localhost:8000
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
@@ -18,6 +20,7 @@ GOOGLE_REDIRECT_URI=http://localhost:8000/api/v1/auth/google/callback
 # AUTH_COOKIE_SECURE=true
 # ENVIRONMENT=production
 # FRONTEND_ORIGIN=https://urmiai.com
+# CORS_ORIGINS=https://urmiai.com,http://urmiai.com,https://www.urmiai.com,http://www.urmiai.com
 # VITE_API_URL=https://api.urmiai.com
 # GOOGLE_REDIRECT_URI=https://api.urmiai.com/api/v1/auth/google/callback
 # VOICE_RELAY_PUBLIC_URL=wss://api.urmiai.com/api/v1/voice

backend/.env.example

@@ -13,6 +13,7 @@ DATABASE_URL=postgresql+psycopg://urmi:urmi@localhost:5433/urmi
 # Must match the browser origin serving the frontend (CORS + OAuth redirect target)
 FRONTEND_ORIGIN=http://localhost:5173
 # Production: FRONTEND_ORIGIN=https://urmiai.com
+# Production: CORS_ORIGINS=https://urmiai.com,http://urmiai.com,https://www.urmiai.com,http://www.urmiai.com
 
 # --- Auth / sessions ---
 # Required in production. Use at least 32 random characters.

backend/app/config.py

@@ -1,3 +1,4 @@
+from pydantic import computed_field
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -6,6 +7,8 @@ class Settings(BaseSettings):
     environment: str = "development"
     database_url: str = "postgresql+psycopg://urmi:urmi@localhost:5432/urmi"
     frontend_origin: str = "http://localhost:5173"
+    # Comma-separated browser origins for CORS (defaults to frontend_origin only)
+    cors_origins: str = ""
     auth_secret: str = "change-me-in-production"
     auth_cookie_secure: bool = False
     access_token_minutes: int = 60 * 24 * 7
@@ -34,5 +37,13 @@ class Settings(BaseSettings):
         extra="ignore",
     )
 
+    @computed_field  # type: ignore[prop-decorator]
+    @property
+    def cors_allowed_origins(self) -> list[str]:
+        configured = [item.strip() for item in self.cors_origins.split(",") if item.strip()]
+        if configured:
+            return configured
+        return [self.frontend_origin]
+
 
 settings = Settings()

backend/app/main.py

@@ -66,7 +66,7 @@ app = FastAPI(
 )
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=[settings.frontend_origin],
+    allow_origins=settings.cors_allowed_origins,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],

docker-compose.yml

@@ -28,6 +28,7 @@ services:
       REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}
       ENVIRONMENT: ${ENVIRONMENT:-development}
       FRONTEND_ORIGIN: ${FRONTEND_ORIGIN:-http://localhost:5173}
+      CORS_ORIGINS: ${CORS_ORIGINS:-}
       AUTH_SECRET: ${AUTH_SECRET:-urmi-local-development-secret-change-me}
       AUTH_COOKIE_SECURE: ${AUTH_COOKIE_SECURE:-false}
       GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}