costa-rica: CORS on /api/app for web build + browser previews (app surface only) — TK-10346

96cd33978a38d99e47526ca74e358e7ec0da3b68 · 2026-08-07 15:33:33 -0700 · Steve

Files touched

M server.js

Diff

commit 96cd33978a38d99e47526ca74e358e7ec0da3b68
Author: Steve <steve@designerwallcoverings.com>
Date:   Fri Aug 7 15:33:33 2026 -0700

    costa-rica: CORS on /api/app for web build + browser previews (app surface only) — TK-10346
---
 server.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server.js b/server.js
index 745a641..5c17ce2 100644
--- a/server.js
+++ b/server.js
@@ -15,6 +15,16 @@ const pool = new Pool({ connectionString: process.env.DATABASE_URL });
 const app = express();
 app.set('trust proxy', true);
 
+// CORS for the /api/app mobile surface (native app has no origin; the web build
+// + browser previews need this). Permissive on the app API only.
+app.use('/api/app', (req, res, next) => {
+  res.set('Access-Control-Allow-Origin', '*');
+  res.set('Access-Control-Allow-Headers', 'Authorization, Content-Type');
+  res.set('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+  if (req.method === 'OPTIONS') return res.sendStatus(204);
+  next();
+});
+
 // Payment/WhatsApp webhooks need the RAW body for HMAC verification, so mount
 // them BEFORE the global JSON parser (and before the site basic-auth gate).
 app.use('/webhooks', require('./routes/webhooks'));

← 5b9c80e costa-rica: sandbox+security tests for plaid.js & whatsapp.j · back to Costa Rica · costa-rica: Cody-gate fixes on plaid/whatsapp tests — fix re 59dfc76 →