Sequential Thinking MVP Server

/** * CORS Middleware */ import http from 'http'; const ALLOWED_ORIGINS = process.env.ALLOWED_ORIGINS?.split(',') || []; const isDevelopment = process.env.NODE_ENV === 'development'; /** * Set CORS headers on response */ export function setCorsHeaders( req: http.IncomingMessage, res: http.ServerResponse ): void { const origin = req.headers.origin; if (isDevelopment) { // In development, allow all origins res.setHeader('Access-Control-Allow-Origin', '*'); } else if (origin && ALLOWED_ORIGINS.includes(origin)) { // In production, only allow configured origins res.setHeader('Access-Control-Allow-Origin', origin); res.setHeader('Access-Control-Allow-Credentials', 'true'); } else if (ALLOWED_ORIGINS.length === 0) { // If no origins configured, allow all (with warning) console.warn('WARNING: No ALLOWED_ORIGINS configured. Allowing all origins. Set ALLOWED_ORIGINS environment variable for production.'); res.setHeader('Access-Control-Allow-Origin', '*'); } res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS'); res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization'); } /** * Handle CORS preflight requests */ export function handlePreflight( req: http.IncomingMessage, res: http.ServerResponse ): boolean { if (req.method === 'OPTIONS') { setCorsHeaders(req, res); res.writeHead(200); res.end(); return true; } return false; }