feat (cors): add cors conf from env

.env.example

@@ -5,3 +5,4 @@ MYSQL_PASSWORD=visione
 MYSQL_ROOT_PASSWORD=root
 MAILHOG_SMTP_PORT=1025
 MAILHOG_WEB_PORT=8025
+CORS_ALLOWED_ORIGIN=http://localhost:3000

common/Cors.cc

@@ -6,91 +6,33 @@ namespace visione::cors
 {
 namespace
 {
-std::vector<std::string> allowedOrigins()
+std::string allowedOrigin()
 {
-    auto cfg = drogon::app().getCustomConfig();
+    return drogon::app()
-    std::vector<std::string> origins;
+        .getCustomConfig()["cors"]
-
+        .get("allowed_origin", "http://localhost:5173")
-    if (cfg.isMember("cors") && cfg["cors"].isObject())
+        .asString();
-    {
-        auto &c = cfg["cors"];
-        if (c.isMember("allowed_origin"))
-        {
-            auto &v = c["allowed_origin"];
-            if (v.isArray())
-            {
-                for (const auto &el : v)
-                {
-                    if (el.isString())
-                        origins.emplace_back(el.asString());
-                }
-            }
-            else if (v.isString())
-            {
-                origins.emplace_back(v.asString());
-            }
-        }
-    }
-
-    if (origins.empty())
-        origins.emplace_back("http://localhost:5173");
-
-    return origins;
 }
 
 bool isAllowed(const drogon::HttpRequestPtr &request)
 {
-    auto origin = request->getHeader("Origin");
+    return request->getHeader("Origin") == allowedOrigin();
-    if (origin.empty())
-        return false;
-
-    auto origins = allowedOrigins();
-    for (const auto &o : origins)
-    {
-        if (o == "*" || o == origin)
-            return true;
-    }
-    return false;
 }
 
 void addHeaders(const drogon::HttpRequestPtr &request,
                 const drogon::HttpResponsePtr &response)
 {
-    auto origin = request->getHeader("Origin");
+    if (!isAllowed(request))
-    if (origin.empty())
-        return;
-
-    auto origins = allowedOrigins();
-    bool allowAll = false;
-    bool matched = false;
-    for (const auto &o : origins)
     {
-        if (o == "*")
+        return;
-        {
-            allowAll = true;
-            break;
-        }
-        if (o == origin)
-        {
-            matched = true;
-            break;
-        }
     }
 
-    if (!allowAll && !matched)
+    response->addHeader("Access-Control-Allow-Origin", allowedOrigin());
-        return;
-
-    if (allowAll)
-        response->addHeader("Access-Control-Allow-Origin", "*");
-    else
-        response->addHeader("Access-Control-Allow-Origin", origin);
-
     response->addHeader("Access-Control-Allow-Credentials", "true");
     response->addHeader("Access-Control-Allow-Methods",
                         "GET,POST,PATCH,DELETE,OPTIONS");
     response->addHeader("Access-Control-Allow-Headers",
                         "Authorization,Content-Type");
-    response->addHeader("Vary", "Origin");
 }
 }  // namespace
 

config.json

@@ -63,7 +63,7 @@
       "spec_path": "build/openapi/visione.openapi.json"
     },
     "cors": {
-      "allowed_origin": ["http://localhost:3000", "http://localhost:5137"]
+      "allowed_origin": "http://localhost:3000"
     }
   }
 }

main.cc

@@ -34,7 +34,8 @@ int main()
             config["custom_config"]["mail"]["smtp_host"] = envSmtpHost;
         if (const char* envSmtpPort = std::getenv("SMTP_PORT"))
             config["custom_config"]["mail"]["smtp_port"] = std::stoi(envSmtpPort);
-
+        if (const char* envCorsAllowedOrigin = std::getenv("CORS_ALLOWED_ORIGIN"))
+            config["custom_config"]["cors"]["allowed_origin"] = envCorsAllowedOrigin;
         drogon::app().loadConfigJson(config);
     }
     else