jjbrunton/Sauci
1
0 Fork 0
mirror of https://github.com/jjbrunton/Sauci.git synced 2026-10-31 18:19:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #27 from jjbrunton/hotfix/admin-cors-origin

Browse Source 
fix(api): allow the admin console origin through CORS
This commit is contained in:
jjbrunton authored and GitHub committed 2026-08-31 18:22:23 +01:00
2 parents 84712a950e 3a019e62d3
commit a06f1b69e8
2 files changed
+8 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

infra/backend/README.md
+6 -3
View File
@@ -87,9 +87,12 @@ Before the first deployment, provide:
5. A rollback and restore point before any migrated production data is imported. 5. A rollback and restore point before any migrated production data is imported.
6. A separately generated `MEDIA_SIGNING_SECRET` (at least 32 characters) and 6. A separately generated `MEDIA_SIGNING_SECRET` (at least 32 characters) and
the HTTPS API origin as `MEDIA_PUBLIC_BASE_URL`. the HTTPS API origin as `MEDIA_PUBLIC_BASE_URL`.
7. The public web origin is fixed to `https://sauci.app` by 7. Browser origins are fixed by `CORS_ALLOWED_ORIGINS` in the Compose contract:
`CORS_ALLOWED_ORIGINS` in the Compose contract. Do not broaden it without a `https://sauci.app` (public web) and `https://manage.sauci.app` (admin
reviewed browser client requirement. console, which calls `/v1/admin/*` with a bearer token). Do not broaden the
list without a reviewed browser client requirement, and add any new admin
host here rather than as a Dokploy override, so the allowlist stays
reviewable in git.
8. A non-production hosted Auth project and disposable, onboarding-complete test 8. A non-production hosted Auth project and disposable, onboarding-complete test
identities mapped into the staging database for authenticated mobile acceptance. identities mapped into the staging database for authenticated mobile acceptance.
infra/backend/compose.production.yaml
+2 -1
View File
@@ -8,7 +8,8 @@ x-common-environment: &common-environment
x-api-environment: &api-environment x-api-environment: &api-environment
<<: *common-environment <<: *common-environment
PORT: 3003 PORT: 3003
CORS_ALLOWED_ORIGINS: https://sauci.app # https://manage.sauci.app is the admin console; it calls /v1/admin/* from the browser.
CORS_ALLOWED_ORIGINS: https://sauci.app,https://manage.sauci.app
DATABASE_POOL_MAX: ${API_DATABASE_POOL_MAX:-10} DATABASE_POOL_MAX: ${API_DATABASE_POOL_MAX:-10}
DATABASE_POOL_IDLE_TIMEOUT_MS: ${DATABASE_POOL_IDLE_TIMEOUT_MS:-30000} DATABASE_POOL_IDLE_TIMEOUT_MS: ${DATABASE_POOL_IDLE_TIMEOUT_MS:-30000}
DATABASE_POOL_CONNECTION_TIMEOUT_MS: ${DATABASE_POOL_CONNECTION_TIMEOUT_MS:-10000} DATABASE_POOL_CONNECTION_TIMEOUT_MS: ${DATABASE_POOL_CONNECTION_TIMEOUT_MS:-10000}