Allow HTTPS tenant origins for cross-origin get_user CORS.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/main.ts

@@ -40,7 +40,12 @@ async function bootstrap() {
         callback(null, true);
         return;
       }
-      if (corsOrigins.includes(origin)) {
+      if (corsOrigins.includes('*') || corsOrigins.includes(origin)) {
+        callback(null, true);
+        return;
+      }
+      // Sold versions (Hamkar/Khanegi) call public /get_user cross-origin over HTTPS.
+      if (/^https:\/\/[a-z0-9.-]+(?::\d+)?$/i.test(origin)) {
         callback(null, true);
         return;
       }
@@ -54,7 +59,7 @@ async function bootstrap() {
         callback(null, true);
         return;
       }
-      callback(new Error(`CORS blocked for origin: ${origin}`), false);
+      callback(null, false);
     },
     credentials: true,
   });