From f6a30e906f28c0e9e25e051d7a17d2ac75896001 Mon Sep 17 00:00:00 2001
From: Levon Tikoyan <ltikoyan@gmail.com>
Date: Thu, 30 Oct 2025 14:11:07 -0400
Subject: [PATCH 1/2] Add allowed origins env var to cors config

---
 .env.example                   |  4 ++--
 src/server/middlewares/cors.ts | 17 +++++++++++------
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/.env.example b/.env.example
index a9db91e3..8e3119db 100644
--- a/.env.example
+++ b/.env.example
@@ -63,5 +63,5 @@ KEYCLOAK_ISSUER=
 KEYCLOAK_CLIENT_ID=
 KEYCLOAK_JWKS_URL=
 
-# LIFECYCLE UI 
-LIFECYCLE_UI_URL='http://localhost:3000'
\ No newline at end of file
+# CORS
+ALLOWED_ORIGINS='https://example.com,https://staging.example.com'
\ No newline at end of file
diff --git a/src/server/middlewares/cors.ts b/src/server/middlewares/cors.ts
index 131f6270..7f3688f2 100644
--- a/src/server/middlewares/cors.ts
+++ b/src/server/middlewares/cors.ts
@@ -17,14 +17,19 @@
 import { NextResponse } from 'next/server';
 import type { Middleware } from './chain';
 
-const corsHeaders = {
-  'Access-Control-Allow-Origin': process.env.LIFECYCLE_UI_URL,
-  'Access-Control-Allow-Credentials': 'true',
-  'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
-  'Access-Control-Allow-Headers': 'Content-Type, Authorization',
-};
+const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(',').map((o) => o.trim()) ?? [];
 
 export const corsMiddleware: Middleware = async (request, next) => {
+  const origin = request.headers.get('origin');
+  const isAllowedOrigin = origin && allowedOrigins.includes(origin);
+
+  const corsHeaders: Record<string, string> = {
+    'Access-Control-Allow-Origin': isAllowedOrigin ? origin : allowedOrigins[0],
+    'Access-Control-Allow-Credentials': 'true',
+    'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+  };
+
   if (request.method === 'OPTIONS') {
     return new NextResponse(null, { status: 204, headers: corsHeaders });
   }

From 6677f78b3e56448d99d4e29a3be8c85e8cbec9ce Mon Sep 17 00:00:00 2001
From: Levon Tikoyan <ltikoyan@gmail.com>
Date: Thu, 30 Oct 2025 14:17:31 -0400
Subject: [PATCH 2/2] fix

---
 next.config.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/next.config.js b/next.config.js
index 586bda0d..6335d304 100644
--- a/next.config.js
+++ b/next.config.js
@@ -66,7 +66,7 @@ module.exports = {
     KEYCLOAK_ISSUER: process.env.KEYCLOAK_ISSUER,
     KEYCLOAK_CLIENT_ID: process.env.KEYCLOAK_CLIENT_ID,
     KEYCLOAK_JWKS_URL: process.env.KEYCLOAK_JWKS_URL,
-    LIFECYCLE_UI_URL: process.env.LIFECYCLE_UI_URL,
+    ALLOWED_ORIGINS: process.env.ALLOWED_ORIGINS,
   },
   typescript: {
     ignoreBuildErrors: true,