fix(server): make CORS origin env-driven, restore CORS_AT_INGRESS interlock

Replace the hardcoded origin:'*' with CORS_ORIGIN (default '*', accepts a
comma-separated list) so the allowed origin lives in the deployment values
instead of the source — keeps published charts publicly embeddable while
letting reusers restrict it. Re-enable the CORS_AT_INGRESS guard so the app
skips its own CORS middleware when the ingress handles it, avoiding duplicate
Access-Control-Allow-Origin headers. Drop the dead commented-out CORS code.

Chart: expose CORS_ORIGIN in server.env and remove the redundant
CORS_AT_INGRESS default (the server-deployment template injects it on
ingress.cors.enabled, so keeping it produced a duplicate env var).

Author: r4770

charts/graph-italia/README.md

@@ -197,7 +197,8 @@ server:
     PORT: "3003"
     DATABASE_URL: "postgresql://user:pass@host:5432/db"
     JWT_SECRET: "your-secret"
-    DOMAINS: "https://graph-italia.example.com"
+    CORS_ORIGIN: "*"   # CORS allowed origin(s); "*" = public embeds, or a comma-separated list to restrict
+    DOMAINS: "https://graph-italia.example.com"   # trusted origins for CSRF (not CORS)
     UPLOAD_SIZE_LIMIT: "15mb"
     ROUTES_PREFIX: "/api"
     SENDER_EMAIL: "noreply@example.com"

charts/graph-italia/values.yaml

@@ -203,8 +203,14 @@ server:
     UPLOAD_SIZE_LIMIT: "15mb"
     ROUTES_PREFIX: ""
     DATABASE_URL: ""
-    # Set to "true" automatically when ingress.cors.enabled=true to avoid duplicate CORS headers
-    CORS_AT_INGRESS: ""
+    # CORS allowed origin(s) for the app-level CORS middleware.
+    # "*" keeps published charts/dashboards embeddable from any site; set a single
+    # origin or a comma-separated list to restrict it. Ignored when CORS is handled
+    # at the ingress (see ingress.cors below, which sets CORS_AT_INGRESS).
+    CORS_ORIGIN: "*"
+    # NOTE: CORS_AT_INGRESS is injected automatically by the server-deployment
+    # template when ingress.cors.enabled=true — do not set it here (it would
+    # produce a duplicate env var).
     # Add other environment variables as needed
   # Horizontal Pod Autoscaler
   autoscaling:

packages/server/index.ts

@@ -54,31 +54,30 @@ const allowHeaders = ["Content-Type", "Authorization", "x-project-id", "Access-C
 
 // CORS must be first so OPTIONS preflights are answered before any other
 // middleware (rate limiter, CSRF, auth) can return a response without headers.
+//
+// Origin is env-driven, never hardcoded: defaults to "*" so that published
+// charts and dashboards stay embeddable from any site, and can be restricted
+// via CORS_ORIGIN (a single origin or a comma-separated list) when reusing
+// this project in a closed context. Public endpoints serve read-only data, so
+// credentials are disabled — the auth cookie is same-origin only.
+const corsOrigin = process.env.CORS_ORIGIN?.includes(",")
+	? process.env.CORS_ORIGIN.split(",").map((o) => o.trim())
+	: process.env.CORS_ORIGIN || "*";
+
 const publicCors = cors({
-	origin: "*",
+	origin: corsOrigin,
 	credentials: false,
 	allowMethods,
 	allowHeaders,
 });
 
-// const privateCors = cors({
-// 	origin: ["https://developers-italia.vercel.app", ...whitelist],
-// 	credentials: true,
-// 	allowMethods,
-// 	allowHeaders,
-// });
-
-// if (!process.env.CORS_AT_INGRESS) {
-app.use("*", publicCors);
-// }
-
-// if (!isDev) {
-// 	app.use(`/charts/*`, publicCors);
-// 	app.use(`/dashboards/*`, publicCors);
-// } else {
-// 	console.warn("cors is enabled for all routes in development mode. make sure to restrict this in production!");
-// 	app.use("/*", privateCors);
-// }
+// When CORS is handled at the ingress (Helm: ingress.cors.enabled=true injects
+// CORS_AT_INGRESS=true), the app skips its own CORS middleware so the response
+// doesn't carry duplicate Access-Control-Allow-Origin headers, which browsers
+// reject.
+if (!process.env.CORS_AT_INGRESS) {
+	app.use("*", publicCors);
+}
 
 // Prometheus metrics collection
 app.use("*", metricsMiddleware);

packages/server/sample.env

@@ -1,5 +1,9 @@
 DATABASE_URL=postgresql://postgres:postgres@db:5432/postgres
 ROUTES_PREFIX=/api
+# CORS allowed origin(s) for the public API. "*" (default) keeps charts embeddable
+# anywhere; set a single origin or a comma-separated list to restrict it.
+CORS_ORIGIN="*"
+# Trusted first-party origins for CSRF protection (comma-separated). Not the CORS list.
 DOMAINS="http://localhost:3000,http://localhost:3003,http://127.0.0.1:3000,http://127.0.0.1:3003"
 JWT_SECRET="una-chiave-segreta-lunga-e-casuale"
 APP_URL="http://127.0.0.1:3000"