preview stack, refresh token, design

backend/src/routes/mod.rs

@@ -1,10 +1,11 @@
+use axum::http::HeaderValue;
 use axum::{
     extract::DefaultBodyLimit,
     middleware,
     routing::{delete, get, patch, post},
     Router,
 };
-use tower_http::cors::{Any, CorsLayer};
+use tower_http::cors::{AllowOrigin, CorsLayer};
 
 use crate::{auth::AuthenticatedUser, state::AppState};
 
@@ -15,13 +16,37 @@ pub mod health;
 pub mod tags;
 
 pub fn create_router(state: AppState) -> Router<()> {
-    let cors = CorsLayer::new()
-        .allow_origin(Any)
-        .allow_methods(Any)
-        .allow_headers(Any);
+    let cors = if let Some(origins) = state.config.cors_allowed_origin.as_ref() {
+        let headers: Vec<HeaderValue> = origins
+            .split(',')
+            .filter_map(|value| {
+                let trimmed = value.trim();
+                (!trimmed.is_empty()).then(|| {
+                    trimmed
+                        .parse::<HeaderValue>()
+                        .expect("invalid CORS allowed origin")
+                })
+            })
+            .collect();
+
+        let allow_origin = AllowOrigin::list(headers);
+
+        CorsLayer::new()
+            .allow_origin(allow_origin)
+            .allow_methods(tower_http::cors::AllowMethods::mirror_request())
+            .allow_headers(tower_http::cors::AllowHeaders::mirror_request())
+            .allow_credentials(true)
+    } else {
+        CorsLayer::new()
+            .allow_origin(AllowOrigin::mirror_request())
+            .allow_methods(tower_http::cors::AllowMethods::mirror_request())
+            .allow_headers(tower_http::cors::AllowHeaders::mirror_request())
+            .allow_credentials(true)
+    };
 
     let auth_routes = Router::new()
         .route("/login", post(auth::login))
+        .route("/refresh", post(auth::refresh))
         .route("/logout", post(auth::logout))
         .route("/me", get(auth::me));