From 1586725a5b7bed26d986d3cb3b0d35a39acfa100 Mon Sep 17 00:00:00 2001
From: Mahdi <mahdi.banilohi@gmail.com>
Date: Mon, 3 Aug 2026 19:47:54 +0330
Subject: [PATCH] Allow HTTPS tenant origins for cross-origin get_user CORS.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .env.example | 1 +
 src/main.ts  | 9 +++++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.env.example b/.env.example
index 50bcf14..b2b0285 100644
--- a/.env.example
+++ b/.env.example
@@ -9,6 +9,7 @@ DATABASE_URL="postgresql://montime:CHANGE_ME@127.0.0.1:5432/superadmin?schema=pu
 JWT_SECRET="change-me-in-production-use-long-random-string"
 JWT_EXPIRES_IN="7d"
 CORS_ORIGIN="http://localhost:5173,http://localhost:3100,https://adm.montzar.ir"
+# Production also allows any https:// sold-version origin for public /get_user (see main.ts).
 # آدرس عمومی API برای ساخت URL لوگو (در پروداکشن دامنه HTTPS سوپرادمین)
 PUBLIC_API_URL="http://localhost:3001"
 
diff --git a/src/main.ts b/src/main.ts
index 40710a3..1d950da 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -40,7 +40,12 @@ async function bootstrap() {
         callback(null, true);
         return;
       }
-      if (corsOrigins.includes(origin)) {
+      if (corsOrigins.includes('*') || corsOrigins.includes(origin)) {
+        callback(null, true);
+        return;
+      }
+      // Sold versions (Hamkar/Khanegi) call public /get_user cross-origin over HTTPS.
+      if (/^https:\/\/[a-z0-9.-]+(?::\d+)?$/i.test(origin)) {
         callback(null, true);
         return;
       }
@@ -54,7 +59,7 @@ async function bootstrap() {
         callback(null, true);
         return;
       }
-      callback(new Error(`CORS blocked for origin: ${origin}`), false);
+      callback(null, false);
     },
     credentials: true,
   });