fix cors production

apps/api/src/app.ts

@@ -55,9 +55,47 @@ const defaultCorsOrigins = [
   'http://127.0.0.1:4000',
 ]
 
-export const corsOrigins = process.env.CORS_ORIGINS
-  ? process.env.CORS_ORIGINS.split(',').map((o) => o.trim()).filter(Boolean)
-  : defaultCorsOrigins
+const frontendOriginEnvKeys = [
+  'SITE_ORIGIN',
+  'WEBSITE_URL',
+  'HOMEPAGE_URL',
+  'DASHBOARD_URL',
+  'ADMIN_URL',
+  'CARPLACE_URL',
+  'NEXT_PUBLIC_HOMEPAGE_URL',
+  'NEXT_PUBLIC_WEBSITE_URL',
+  'NEXT_PUBLIC_DASHBOARD_URL',
+  'NEXT_PUBLIC_ADMIN_URL',
+  'NEXT_PUBLIC_CARPLACE_URL',
+] as const
+
+function normalizeConfiguredOrigin(value: string): string | null {
+  try {
+    return new URL(value).origin
+  } catch {
+    return null
+  }
+}
+
+export function getConfiguredCorsOrigins(env: NodeJS.ProcessEnv = process.env) {
+  const configuredOrigins = (env.CORS_ORIGINS ?? '')
+    .split(',')
+    .map((origin) => origin.trim())
+    .filter(Boolean)
+
+  const frontendOrigins = frontendOriginEnvKeys
+    .flatMap((key) => (env[key] ?? '').split(','))
+    .map((origin) => origin.trim())
+    .filter(Boolean)
+
+  const rawOrigins = configuredOrigins.length > 0 || frontendOrigins.length > 0
+    ? [...configuredOrigins, ...frontendOrigins]
+    : defaultCorsOrigins
+
+  return Array.from(new Set(rawOrigins.map(normalizeConfiguredOrigin).filter((origin): origin is string => Boolean(origin))))
+}
+
+export const corsOrigins = getConfiguredCorsOrigins()
 
 function isAllowedLocalDevOrigin(origin: string) {
   if (process.env.NODE_ENV === 'production') return false