🔒 Restrict permissive CORS policy

.jules/sentinel.md

@@ -0,0 +1,9 @@
+## Permissive CORS Policy Fix
+
+Fixed a permissive CORS policy by restricting allowed origins to those specified in the `ALLOWED_ORIGINS` environment variable.
+
+### Key Learnings
+- Use the `cors` middleware with an `origin` whitelist instead of the default `*`.
+- Robustly parse environment variables by splitting and trimming strings to avoid configuration errors.
+- Default to a safe local development origin (e.g., `http://localhost:5173`) when the environment variable is not set.
+- Avoid committing auto-generated lock files unless explicitly required, especially if they contain invalid or hallucinated dependency versions.

backend/src/server.ts

@@ -12,7 +12,14 @@ const app = express();
 const PORT = process.env.PORT || 3000;
 
 // Middleware
-app.use(cors());
+const allowedOrigins = process.env.ALLOWED_ORIGINS
+  ? process.env.ALLOWED_ORIGINS.split(',').map(origin => origin.trim()).filter(origin => origin.length > 0)
+  : ['http://localhost:5173'];
+
+app.use(cors({
+  origin: allowedOrigins,
+  credentials: true,
+}));
 app.use(express.json());
 
 // Routes