go-live prep: CORS for cross-origin /trade/apply + .deploy.conf scaffold (still DRY_RUN)

80fab3565eaf674e5b48acf0c3c014d69620c6bb · 2026-07-28 09:57:26 -0700 · Steve Abrams

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

A .deploy.conf
M server.js

Diff

commit 80fab3565eaf674e5b48acf0c3c014d69620c6bb
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Jul 28 09:57:26 2026 -0700

    go-live prep: CORS for cross-origin /trade/apply + .deploy.conf scaffold (still DRY_RUN)
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .deploy.conf |  5 +++++
 server.js    | 19 ++++++++++++++++++-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/.deploy.conf b/.deploy.conf
new file mode 100644
index 0000000..f13e232
--- /dev/null
+++ b/.deploy.conf
@@ -0,0 +1,5 @@
+PROJECT_NAME=dw-signup-fulfillment
+DEPLOY_HOST=45.61.58.125
+DEPLOY_PATH=/root/Projects/dw-signup-fulfillment
+HEALTH_URL=http://127.0.0.1:9856/healthz
+INSTALL_CMD="npm ci --omit=dev"
diff --git a/server.js b/server.js
index 2b9c650..8550ee7 100644
--- a/server.js
+++ b/server.js
@@ -72,8 +72,25 @@ app.post('/webhooks/customers/create',
 app.use(express.json({ limit: '1mb' }));
 app.use(express.urlencoded({ extended: true }));
 
+// --- CORS for the public trade-apply endpoint. The modal fetch()es this from the
+//     Shopify storefront origin (a different host), so allow the DW storefront(s). ---
+const TRADE_ALLOWED_ORIGINS = (process.env.TRADE_ALLOWED_ORIGINS ||
+  'https://www.designerwallcoverings.com,https://designerwallcoverings.com').split(',').map(s => s.trim());
+function tradeCors(req, res, next) {
+  const origin = req.get('Origin');
+  if (origin && TRADE_ALLOWED_ORIGINS.includes(origin)) {
+    res.set('Access-Control-Allow-Origin', origin);
+    res.set('Vary', 'Origin');
+    res.set('Access-Control-Allow-Methods', 'POST, OPTIONS');
+    res.set('Access-Control-Allow-Headers', 'Content-Type');
+  }
+  if (req.method === 'OPTIONS') return res.status(204).end();
+  next();
+}
+app.options('/trade/apply', tradeCors);
+
 // --- Trade application intake (public) ---
-app.post('/trade/apply', (req, res) => {
+app.post('/trade/apply', tradeCors, (req, res) => {
   const b = req.body || {};
   if (!b.email) return res.status(400).json({ ok: false, error: 'email required' });
   const created = trade.apply(b);

← 26d014b theme proposal: returning sign-in front-and-center (email co · back to Dw Signup Fulfillment · retail: rewire webhook to sample-locked shared function code d0059b8 →