use base url for cors

Author: mikebarkmin

platforms/cloud/README.md

@@ -45,7 +45,7 @@ cp .env.example .env
 | `SMTP_USER` | SMTP username | — |
 | `SMTP_PASS` | SMTP password | — |
 | `SMTP_FROM` | Sender email address | `noreply@example.com` |
-| `BASE_URL` | Public URL (used in password reset links) | auto-detected |
+| `BASE_URL` | Public URL (used in password reset links and for CORS) | required |
 
 ## Users & Permissions
 

platforms/cloud/app.js

@@ -15,13 +15,17 @@ var app = express();
 
 var PORT = process.env.PORT || 3001;
 
+var corsOrigins = [process.env.BASE_URL];
+
 app.use(cors({
   origin: async function(origin, callback) {
     if (!origin) return callback(null, true);
 
     var selfOrigin = 'http://localhost:' + PORT;
     if (origin === selfOrigin) return callback(null, true);
 
+    if (corsOrigins.includes(origin)) return callback(null, true);
+
     try {
       var hyperbooks = await db.allAsync(
         'SELECT url FROM hyperbooks WHERE url IS NOT NULL'