From d49109ecb57be2dd7e207421bdc09a865adf2613 Mon Sep 17 00:00:00 2001
From: Lyxminxx <madelen@duck.com>
Date: Mon, 21 Sep 2026 21:54:14 +0200
Subject: [PATCH] added cors

---
 core/settings.py | 13 +++++++++++++
 pyproject.toml   |  1 +
 uv.lock          | 15 +++++++++++++++
 3 files changed, 29 insertions(+)

diff --git a/core/settings.py b/core/settings.py
index a75176a..081266c 100644
--- a/core/settings.py
+++ b/core/settings.py
@@ -55,12 +55,14 @@ INSTALLED_APPS = [
     'django.contrib.staticfiles',
     'core',
     'ninja',
+    'corsheaders',
 ]
 
 MIDDLEWARE = [
     'django.middleware.security.SecurityMiddleware',
     'whitenoise.middleware.WhiteNoiseMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
+    "corsheaders.middleware.CorsMiddleware",
     'django.middleware.common.CommonMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',
@@ -70,6 +72,17 @@ MIDDLEWARE = [
 
 ROOT_URLCONF = 'core.urls'
 
+cors_env = os.getenv("CORS_ALLOWED_ORIGINS", "")
+if cors_env:
+    CORS_ALLOWED_ORIGINS = [origin.strip() for origin in cors_env.split(",") if origin.strip()]
+else:
+    CORS_ALLOWED_ORIGINS = [
+        "https://jast.mydomain.com",
+    ]
+
+# Allow credentials (cookies/headers)
+CORS_ALLOW_CREDENTIALS = True
+
 TEMPLATES = [
     {
         'BACKEND': 'django.template.backends.django.DjangoTemplates',
diff --git a/pyproject.toml b/pyproject.toml
index d859a96..4f80ed5 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,6 +6,7 @@ readme = "README.md"
 requires-python = ">=3.14"
 dependencies = [
     "django>=6.1.1",
+    "django-cors-headers>=4.9.0",
     "django-ninja>=1.7.1",
     "gunicorn>=26.2.0",
     "pyjwt>=2.14.0",
diff --git a/uv.lock b/uv.lock
index b33ab74..69ac974 100644
--- a/uv.lock
+++ b/uv.lock
@@ -34,6 +34,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/8d/ca/c1040a4fd15754ede7df15fd72fc2e123045b473b253ab5f5284e11c651e/django-6.1.1-py3-none-any.whl", hash = "sha256:585fb82bf15053c42cf52e67c2f1b54a032dca384759315fd6678ab1870d1d72", size = 8419512, upload-time = "2026-09-02T17:20:39.153Z" },
 ]
 
+[[package]]
+name = "django-cors-headers"
+version = "4.9.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "asgiref" },
+    { name = "django" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/21/39/55822b15b7ec87410f34cd16ce04065ff390e50f9e29f31d6d116fc80456/django_cors_headers-4.9.0.tar.gz", hash = "sha256:fe5d7cb59fdc2c8c646ce84b727ac2bca8912a247e6e68e1fb507372178e59e8", size = 21458, upload-time = "2025-09-18T10:40:52.326Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/30/d8/19ed1e47badf477d17fb177c1c19b5a21da0fd2d9f093f23be3fb86c5fab/django_cors_headers-4.9.0-py3-none-any.whl", hash = "sha256:15c7f20727f90044dcee2216a9fd7303741a864865f0c3657e28b7056f61b449", size = 12809, upload-time = "2025-09-18T10:40:50.843Z" },
+]
+
 [[package]]
 name = "django-ninja"
 version = "1.7.1"
@@ -62,6 +75,7 @@ version = "0.1.0"
 source = { virtual = "." }
 dependencies = [
     { name = "django" },
+    { name = "django-cors-headers" },
     { name = "django-ninja" },
     { name = "gunicorn" },
     { name = "pyjwt" },
@@ -71,6 +85,7 @@ dependencies = [
 [package.metadata]
 requires-dist = [
     { name = "django", specifier = ">=6.1.1" },
+    { name = "django-cors-headers", specifier = ">=4.9.0" },
     { name = "django-ninja", specifier = ">=1.7.1" },
     { name = "gunicorn", specifier = ">=26.2.0" },
     { name = "pyjwt", specifier = ">=2.14.0" },