fix cors production

apps/api/src/tests/api/api-foundation.api.test.ts

@@ -16,7 +16,7 @@ vi.mock('../../lib/redis', () => ({
 
 import request from 'supertest'
 import { describe, expect, it } from 'vitest'
-import { createApp, isCorsOriginAllowed } from '../../app'
+import { createApp, getConfiguredCorsOrigins, isCorsOriginAllowed } from '../../app'
 import { isTrustedBrowserOrigin } from '../../middleware/csrf'
 
 const app = createApp()
@@ -88,6 +88,22 @@ describe('API foundation integration', () => {
     expect(res.headers['access-control-allow-credentials']).toBe('true')
   })
 
+  it('derives production CORS origins from configured frontend URLs when CORS_ORIGINS is absent', () => {
+    expect(getConfiguredCorsOrigins({
+      NODE_ENV: 'production',
+      SITE_ORIGIN: 'https://rentaldrivego.ma',
+      NEXT_PUBLIC_DASHBOARD_URL: 'https://rentaldrivego.ma/dashboard',
+      NEXT_PUBLIC_ADMIN_URL: 'https://rentaldrivego.ma/admin',
+    })).toEqual(['https://rentaldrivego.ma'])
+  })
+
+  it('normalizes explicit CORS origins and frontend URL origins without duplicates', () => {
+    expect(getConfiguredCorsOrigins({
+      CORS_ORIGINS: 'https://rentaldrivego.ma, https://www.rentaldrivego.ma',
+      NEXT_PUBLIC_DASHBOARD_URL: 'https://rentaldrivego.ma/dashboard',
+    })).toEqual(['https://rentaldrivego.ma', 'https://www.rentaldrivego.ma'])
+  })
+
   it('trusts private LAN app origins during local development only on known app ports', () => {
     expect(isCorsOriginAllowed('http://192.168.3.3:3000')).toBe(true)
     expect(isTrustedBrowserOrigin('http://192.168.3.3:3000')).toBe(true)