From 64d13581df1f5fc0f2c66f8de24d170e1e04d3ab Mon Sep 17 00:00:00 2001
From: Tiago Yamamoto <tiago.ribeiro@inventcloud.com.br>
Date: Sat, 27 Dec 2025 00:42:57 -0300
Subject: [PATCH] feat: enable CORS in backoffice with configurable origins

---
 backoffice/.env.example | 1 +
 backoffice/src/main.ts  | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/backoffice/.env.example b/backoffice/.env.example
index 0edc61b..92e8016 100644
--- a/backoffice/.env.example
+++ b/backoffice/.env.example
@@ -2,3 +2,4 @@ DATABASE_URL=postgresql://user:password@host:port/dbname?schema=public
 JWT_SECRET=dev-secret
 PORT=3000
 API_URL=http://localhost:3000
+CORS_ORIGINS=*
diff --git a/backoffice/src/main.ts b/backoffice/src/main.ts
index afebe86..f57c2a9 100644
--- a/backoffice/src/main.ts
+++ b/backoffice/src/main.ts
@@ -13,6 +13,12 @@ async function bootstrap() {
   );
 
   const configService = app.get(ConfigService);
+  const corsOrigins = configService.get<string>('CORS_ORIGINS', '*');
+
+  app.enableCors({
+    origin: corsOrigins === '*' ? '*' : corsOrigins.split(','),
+    credentials: true,
+  });
 
   const cookieOptions: FastifyCookieOptions = {
     parseOptions: {