Add production-ready SuperAdmin API features for tenants, SMS, servers, and plugins.

Includes mobile auth, get_user/get_version, SMS wallet parity endpoints, appearance backfill, and related Prisma migrations.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/main.ts

@@ -1,18 +1,61 @@
 import { NestFactory } from '@nestjs/core';
 import { RequestMethod, ValidationPipe } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
+import { NestExpressApplication } from '@nestjs/platform-express';
 import { AppModule } from './app.module';
+import { ensureUploadsDirs, UPLOADS_ROOT } from './uploads/uploads.util';
 
 async function bootstrap() {
-  const app = await NestFactory.create(AppModule);
+  const app = await NestFactory.create<NestExpressApplication>(AppModule);
   const config = app.get(ConfigService);
 
+  ensureUploadsDirs();
+  app.useStaticAssets(UPLOADS_ROOT, { prefix: '/uploads/' });
+
   app.setGlobalPrefix('api', {
-    exclude: [{ path: 'get_user', method: RequestMethod.GET }],
+    exclude: [
+      { path: 'get_user', method: RequestMethod.GET },
+      { path: 'get_version', method: RequestMethod.GET },
+      { path: 'uploads/(.*)', method: RequestMethod.GET },
+    ],
   });
 
+  const corsOriginRaw = config.get<string>(
+    'CORS_ORIGIN',
+    'http://localhost:5173,http://localhost:3100',
+  );
+  const corsOrigins = corsOriginRaw
+    .split(',')
+    .map((item) => item.trim())
+    .filter(Boolean);
+
+  const isDev = (config.get<string>('NODE_ENV') ?? process.env.NODE_ENV) !== 'production';
+
   app.enableCors({
-    origin: config.get<string>('CORS_ORIGIN', 'http://localhost:5173'),
+    origin: (
+      origin: string | undefined,
+      callback: (err: Error | null, allow?: boolean) => void,
+    ) => {
+      if (!origin) {
+        callback(null, true);
+        return;
+      }
+      if (corsOrigins.includes(origin)) {
+        callback(null, true);
+        return;
+      }
+      // Vite روی LAN (مثلاً 172.x / 192.168.x) در توسعه
+      if (
+        isDev &&
+        /^http:\/\/(localhost|127\.0\.0\.1|192\.168\.\d+\.\d+|172\.\d+\.\d+\.\d+|10\.\d+\.\d+\.\d+):\d+$/.test(
+          origin,
+        )
+      ) {
+        callback(null, true);
+        return;
+      }
+      callback(new Error(`CORS blocked for origin: ${origin}`), false);
+    },
     credentials: true,
   });