Allow HTTPS tenant origins for cross-origin get_user CORS.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -9,6 +9,7 @@ DATABASE_URL="postgresql://montime:CHANGE_ME@127.0.0.1:5432/superadmin?schema=pu
 JWT_SECRET="change-me-in-production-use-long-random-string"
 JWT_EXPIRES_IN="7d"
 CORS_ORIGIN="http://localhost:5173,http://localhost:3100,https://adm.montzar.ir"
+# Production also allows any https:// sold-version origin for public /get_user (see main.ts).
 # آدرس عمومی API برای ساخت URL لوگو (در پروداکشن دامنه HTTPS سوپرادمین)
 PUBLIC_API_URL="http://localhost:3001"
 

src/main.ts

@@ -40,7 +40,12 @@ async function bootstrap() {
         callback(null, true);
         return;
       }
-      if (corsOrigins.includes(origin)) {
+      if (corsOrigins.includes('*') || corsOrigins.includes(origin)) {
+        callback(null, true);
+        return;
+      }
+      // Sold versions (Hamkar/Khanegi) call public /get_user cross-origin over HTTPS.
+      if (/^https:\/\/[a-z0-9.-]+(?::\d+)?$/i.test(origin)) {
         callback(null, true);
         return;
       }
@@ -54,7 +59,7 @@ async function bootstrap() {
         callback(null, true);
         return;
       }
-      callback(new Error(`CORS blocked for origin: ${origin}`), false);
+      callback(null, false);
     },
     credentials: true,
   });