[PK-57] BE: pridanie CORS middleware pre /api/* #17

Merged

forge-admin merged 1 commit from agent/be-dev/225e8d69 into main

2026-05-17 00:37:24 +00:00

forge-admin commented

2026-05-17 00:37:14 +00:00

Owner

Fix pre PK-57 — BE-side CORS middleware (variant A z tech-lead návrhu) pre /api/*.

Zmeny

be/middleware.ts — Next.js middleware s matcher: [/api/:path*], OPTIONS preflight → 204 s CORS hlavičkami.
be/lib/cors.ts — allow-list cez env CORS_ALLOWED_ORIGINS (comma-separated; default http://localhost:3000).
be/.env.example, root .env.example, docker-compose.yml — pridaná CORS_ALLOWED_ORIGINS.
be/tests/cors.test.ts — 11 testov (preflight, allow-listed, odmietnutý, no-Origin, multi-origin).
be/README.md — sekcia CORS.

Overenie

npm test → 196/196 passed.
Manuálny curl preflight test → 204 + všetky 4 CORS hlavičky.

AC schválené tech-leadom.

Fix pre [PK-57](https://multica) — BE-side CORS middleware (variant A z tech-lead návrhu) pre /api/*. ## Zmeny - `be/middleware.ts` — Next.js middleware s `matcher: [/api/:path*]`, OPTIONS preflight → 204 s CORS hlavičkami. - `be/lib/cors.ts` — allow-list cez env `CORS_ALLOWED_ORIGINS` (comma-separated; default `http://localhost:3000`). - `be/.env.example`, root `.env.example`, `docker-compose.yml` — pridaná `CORS_ALLOWED_ORIGINS`. - `be/tests/cors.test.ts` — 11 testov (preflight, allow-listed, odmietnutý, no-Origin, multi-origin). - `be/README.md` — sekcia CORS. ## Overenie - `npm test` → 196/196 passed. - Manuálny curl preflight test → 204 + všetky 4 CORS hlavičky. AC schválené tech-leadom.

forge-admin added 1 commit

2026-05-17 00:37:14 +00:00

[PK-57] BE: pridanie CORS middleware pre /api/* e6c3e52e7a

FE (http://localhost:3000) volá BE (http://localhost:3001) cross-origin
s credentials: 'include', preto BE musí odpovedať na preflight OPTIONS
a posielať Access-Control-Allow-* hlavičky. Bez nich browser CORS blokuje
add-to-cart aj checkout (PK-57).

- middleware.ts + lib/cors.ts: allow-list cez env CORS_ALLOWED_ORIGINS
  (comma-separated), default http://localhost:3000; OPTIONS preflight
  vracia 204 s Allow-Origin/Credentials/Methods/Headers/Vary;
  bežné odpovede dostanú rovnaké hlavičky pre allow-listed Origin.
- Nepoužívame wildcard Origin (`*`) — nezlúčiteľné s Allow-Credentials.
- Env: CORS_ALLOWED_ORIGINS pridané do be/.env.example, root .env.example
  a docker-compose.yml (default zachováva existujúce dev správanie).
- Testy: tests/cors.test.ts — 11 testov pre middleware aj helper
  (preflight, allow-listed/odmietnutý Origin, multi-origin, no-Origin SSR).
- README (be/): nová sekcia CORS s popisom správania.

Co-authored-by: multica-agent <github@multica.ai>