chore: CORS permission changed from * to frontend

Author: Annonnymmousss

src/backend/auth/github.ts

@@ -77,7 +77,7 @@ async function authenticateAndCreateJWT(
 
     console.log("DB Status for User:", userId, status);
 
-    ctx.response.headers.set("Access-Control-Allow-Origin", "*");
+
 
     if (status.matchedCount == 1 || status.upsertedId !== undefined) {
       const id_jwt = await createJWT(provider, userId);
@@ -94,7 +94,6 @@ async function authenticateAndCreateJWT(
 }
 
 async function handleJwtAuthentication(ctx: Context) {
-  ctx.response.headers.set("Access-Control-Allow-Origin", "*");
   if (!ctx.request.hasBody) {
     ctx.throw(415);
   }

src/backend/health-api.ts

@@ -31,7 +31,7 @@ export async function getContainerHealth(ctx: Context): Promise<void> {
 
     const summary = await getHealthSummary();
 
-    ctx.response.headers.set("Access-Control-Allow-Origin", "*");
+
     ctx.response.body = {
         total: summary.total,
         healthy: summary.healthy,
@@ -68,7 +68,7 @@ export async function getContainerMetrics(ctx: Context): Promise<void> {
 
     const history = await getContainerHistory(subdomain, range);
 
-    ctx.response.headers.set("Access-Control-Allow-Origin", "*");
+
     ctx.response.body = {
         subdomain,
         step: range.step,
@@ -98,7 +98,7 @@ export async function getHealthDashboard(ctx: Context): Promise<void> {
     const summary = await getHealthSummary();
     const monitorStatus = getMonitorStatus();
 
-    ctx.response.headers.set("Access-Control-Allow-Origin", "*");
+
     ctx.response.body = {
         overview: {
             total: summary.total,
@@ -147,7 +147,7 @@ export async function restartContainerHandler(ctx: Context): Promise<void> {
     try {
         await restartContainer(subdomain);
 
-        ctx.response.headers.set("Access-Control-Allow-Origin", "*");
+
         ctx.response.body = {
             status: "success",
             message: `Container ${subdomain} restart initiated`,
@@ -183,7 +183,7 @@ export async function stopContainerHandler(ctx: Context): Promise<void> {
     try {
         await stopContainer(subdomain);
 
-        ctx.response.headers.set("Access-Control-Allow-Origin", "*");
+
         ctx.response.body = {
             status: "success",
             message: `Container ${subdomain} stop initiated`,
@@ -218,7 +218,6 @@ export async function triggerHealthCheckHandler(ctx: Context): Promise<void> {
 
     await triggerHealthCheck();
 
-    ctx.response.headers.set("Access-Control-Allow-Origin", "*");
     ctx.response.body = {
         status: "success",
         message: "Health check triggered",

src/backend/main.ts

@@ -13,7 +13,7 @@ async function getSubdomains(ctx: Context) {
     ctx.throw(401);
   }
   const data = await getMaps(author, ADMIN_LIST!);
-  ctx.response.headers.set("Access-Control-Allow-Origin", "*");
+
   ctx.response.body = data.documents;
 }
 
@@ -44,7 +44,7 @@ async function addSubdomain(ctx: Context) {
     ctx.throw(401);
   }
   const success: boolean = await addMaps(document);
-  ctx.response.headers.set("Access-Control-Allow-Origin", "*");
+
 
   if (success) {
     await addScript(
@@ -93,7 +93,7 @@ async function deleteSubdomain(ctx: Context) {
       "info",
     );
   }
-  ctx.response.headers.set("Access-Control-Allow-Origin", "*");
+
   ctx.response.body = data;
 }
 

src/backend/server.ts

@@ -80,7 +80,7 @@ router
   .post("/health/:subdomain/stop", (ctx) => stopContainerHandler(ctx))
   .post("/health/check", (ctx) => triggerHealthCheckHandler(ctx));
 
-app.use(oakCors());
+app.use(oakCors({ origin: frontend }));
 app.use(router.routes());
 app.use(router.allowedMethods());