feat: implement CORS support with configurable origins

Author: mitchdowney

.example.env

@@ -16,6 +16,7 @@ LOG_LEVEL=info
 API_PORT=1234
 API_PREFIX=/api
 API_VERSION=/v2
+API_ALLOWED_CORS_ORIGINS=http://localhost:3000,https://api.podverse.fm,https://podverse.fm
 
 AUTH_JWT_SECRET=your-secret-whatever
 

package-lock.json

@@ -35,6 +35,7 @@
     "bcrypt": "^5.1.1",
     "body-parser": "^1.20.2",
     "cookie-parser": "^1.4.7",
+    "cors": "^2.8.5",
     "express": "^4.19.2",
     "joi": "^17.13.3",
     "jsonwebtoken": "^9.0.2",
@@ -57,6 +58,7 @@
     "@eslint/js": "^9.8.0",
     "@types/bcrypt": "^5.0.2",
     "@types/cookie-parser": "^1.4.8",
+    "@types/cors": "^2.8.19",
     "@types/express": "^4.17.21",
     "@types/jest": "^29.5.14",
     "@types/node": "^22.0.0",

package.json

@@ -1,6 +1,7 @@
 import "reflect-metadata";
 import bodyParser from 'body-parser';
 import cookieParser from 'cookie-parser';
+import cors from 'cors';
 import express, { NextFunction, Request, Response } from "express";
 import { CategoryService } from "podverse-orm";
 import { config } from '@api/config';
@@ -23,6 +24,11 @@ import { loggerService } from "./factories/loggerService";
 export const app = express();
 const port = 1234;
 
+app.use(cors({
+  origin: config.api.allowedCORSOrigins,
+  credentials: true
+}));
+
 app.use(bodyParser.json());
 app.use(bodyParser.urlencoded({ extended: true }));
 

src/app.ts

@@ -22,6 +22,7 @@ type Config = {
       domain: string;
       secure: boolean;
     };
+    allowedCORSOrigins: string[];
   };
   email: {
     styles: {
@@ -90,6 +91,7 @@ export const config: Config = {
       domain: process.env.COOKIE_DOMAIN || 'localhost',
       secure: process.env.COOKIE_SECURE === 'true',
     },
+    allowedCORSOrigins: (process.env.API_ALLOWED_CORS_ORIGINS || '').split(',').map(origin => origin.trim()),
   },
   email: {
     styles: {