feat: cors done

Author: olawale880

backend/.env.example

@@ -22,10 +22,20 @@ STELLAR_NETWORK_PASSPHRASE=Test SDF Network ; September 2015
 # Vault Configuration
 VAULT_CONTRACT_ID=
 
-# Optional: Database Configuration (for future use)
-# DATABASE_URL=
-# DATABASE_POOL_SIZE=10
+# Optional: Database Configuration
+DATABASE_URL=
+DATABASE_REPLICA_URL=
+DATABASE_POOL_SIZE=10
 
 # Optional: Cache Configuration (for future use)
 # REDIS_URL=redis://localhost:6379
 # CACHE_TTL=300
+
+# CORS Configuration
+# Comma-separated list of allowed origins. Supports strings or regex like /https?:\/\/.*\.yieldvault\.finance/
+CORS_ALLOWED_ORIGINS=http://localhost:3000,https://app.yieldvault.finance
+
+# Email Notification Configuration
+EMAIL_PROVIDER=resend
+EMAIL_API_KEY=
+EMAIL_FROM_ADDRESS=notifications@yieldvault.finance

backend/package-lock.json

@@ -21,24 +21,27 @@
   "author": "",
   "license": "MIT",
   "dependencies": {
+    "cors": "^2.8.6",
+    "dotenv": "^16.3.1",
     "express": "^4.18.2",
     "express-rate-limit": "^7.0.0",
-    "dotenv": "^16.3.1",
-    "node-cache": "^5.1.2"
+    "node-cache": "^5.1.2",
+    "prom-client": "^15.1.3"
   },
   "devDependencies": {
+    "@types/cors": "^2.8.19",
     "@types/express": "^4.17.17",
-    "@types/node": "^20.0.0",
     "@types/jest": "^29.5.0",
-    "typescript": "^5.1.0",
-    "tsx": "^4.0.0",
-    "jest": "^29.5.0",
-    "ts-jest": "^29.1.0",
-    "supertest": "^6.3.3",
+    "@types/node": "^20.0.0",
     "@types/supertest": "^2.0.12",
-    "eslint": "^8.40.0",
     "@typescript-eslint/eslint-plugin": "^5.59.0",
     "@typescript-eslint/parser": "^5.59.0",
-    "prettier": "^3.0.0"
+    "eslint": "^8.40.0",
+    "jest": "^29.5.0",
+    "prettier": "^3.0.0",
+    "supertest": "^6.3.3",
+    "ts-jest": "^29.1.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.1.0"
   }
 }

backend/package.json

@@ -0,0 +1,76 @@
+import request from 'supertest';
+import express, { Express } from 'express';
+import { corsMiddleware } from '../middleware/cors';
+
+describe('CORS Middleware', () => {
+  let app: Express;
+
+  beforeAll(() => {
+    app = express();
+    // Set a dummy environment origin for testing
+    process.env.CORS_ALLOWED_ORIGINS = 'http://trusted-frontend.com,https://app.yieldvault.finance';
+    process.env.NODE_ENV = 'production';
+    
+    app.use(corsMiddleware);
+    app.get('/test', (req, res) => {
+      res.status(200).json({ message: 'Success' });
+    });
+  });
+
+  it('should allow requests from a trusted origin', async () => {
+    const response = await request(app)
+      .get('/test')
+      .set('Origin', 'http://trusted-frontend.com');
+
+    expect(response.status).toBe(200);
+    expect(response.header['access-control-allow-origin']).toBe('http://trusted-frontend.com');
+    expect(response.header['access-control-allow-credentials']).toBe('true');
+  });
+
+  it('should allow requests from another trusted origin', async () => {
+    const response = await request(app)
+      .get('/test')
+      .set('Origin', 'https://app.yieldvault.finance');
+
+    expect(response.status).toBe(200);
+    expect(response.header['access-control-allow-origin']).toBe('https://app.yieldvault.finance');
+  });
+
+  it('should reject requests from an untrusted origin with 403', async () => {
+    const response = await request(app)
+      .get('/test')
+      .set('Origin', 'http://malicious-site.com');
+
+    expect(response.status).toBe(403);
+    expect(response.body).toHaveProperty('error', 'Forbidden');
+    expect(response.body).toHaveProperty('message', 'CORS policy: This origin is not allowed access.');
+    expect(response.header['access-control-allow-origin']).toBeUndefined();
+  });
+
+  it('should allow requests with no origin (e.g., mobile apps, curl)', async () => {
+    const response = await request(app).get('/test');
+
+    expect(response.status).toBe(200);
+    expect(response.body).toHaveProperty('message', 'Success');
+  });
+
+  it('should return correct headers for preflight OPTIONS requests from trusted origin', async () => {
+    const response = await request(app)
+      .options('/test')
+      .set('Origin', 'http://trusted-frontend.com')
+      .set('Access-Control-Request-Method', 'POST');
+
+    expect(response.status).toBe(200);
+    expect(response.header['access-control-allow-origin']).toBe('http://trusted-frontend.com');
+    expect(response.header['access-control-allow-methods']).toContain('POST');
+  });
+
+  it('should reject preflight OPTIONS requests from untrusted origin with 403', async () => {
+    const response = await request(app)
+      .options('/test')
+      .set('Origin', 'http://malicious-site.com')
+      .set('Access-Control-Request-Method', 'POST');
+
+    expect(response.status).toBe(403);
+  });
+});