fix: read http-server CORS origin from CORS_ORIGIN

CONTRIBUTING.md

@@ -54,6 +54,10 @@ DATABASE_URL=postgresql://postgres:postgres@db:5432/Qtrive
 
 FRONTEND_URL=http://localhost:5173
 
+# Comma-separated origins the browser may call the API from.
+# Optional, this is the default.
+CORS_ORIGIN=http://localhost:5173
+
 ```
 
 *When running `/apps/ws-server` outside Docker*, copy `.env.example` and put

apps/http-server/src/index.ts

@@ -11,8 +11,15 @@ import { requestLogger } from './middlewares/requestLogger'
 
 const app: Express = express()
 
+// Comma-separated list, same as apps/streaming. Production sets this to the
+// real site in .env.prod.
+const corsOrigins = (process.env.CORS_ORIGIN || 'http://localhost:5173')
+    .split(',')
+    .map((origin) => origin.trim())
+    .filter(Boolean)
+
 app.use(cors({
-    origin: 'https://rexial.in',
+    origin: corsOrigins,
     credentials: true
 }))
 app.use(requestLogger)

setup.md

@@ -65,6 +65,10 @@ DATABASE_URL=postgresql://postgres:postgres@db:5432/Qtrive
 
 FRONTEND_URL=http://localhost:5173
 
+# Comma-separated origins the browser may call the API from.
+# Optional, this is the default.
+CORS_ORIGIN=http://localhost:5173
+
 ```
 
 If you run the WebSocket server outside Docker, copy its example environment