Upload 34 files

src/app.js

@@ -47,6 +47,11 @@ app.use(
   cors({
     origin(origin, callback) {
       if (!origin || env.clientOrigins.includes(origin)) return callback(null, true);
+      // Logged (not just thrown) so a mismatched frontend domain shows up
+      // immediately in the server logs with the exact rejected value —
+      // compare this directly against the CORS allow-list logged at
+      // startup to spot typos, protocol mismatches, or a missing entry.
+      logger.warn(`CORS rejected origin: "${origin}" (allow-list: ${JSON.stringify(env.clientOrigins)})`);
       return callback(new Error("Not allowed by CORS"));
     },
     credentials: true,

src/server.js

@@ -12,6 +12,13 @@ async function start() {
     await connectDB();
     server = app.listen(env.port, () => {
       logger.info(`Aynwerd API listening on port ${env.port} [${env.nodeEnv}]`);
+      // Logged deliberately at startup: this is the #1 source of CORS
+      // support confusion (a typo'd env var name, stray quotes, a
+      // trailing slash, or the value falling back to its localhost
+      // default because it was never actually set). Seeing the parsed
+      // array here removes all guesswork versus staring at the raw
+      // dashboard value.
+      logger.info(`CORS allow-list (CLIENT_ORIGINS parsed as): ${JSON.stringify(env.clientOrigins)}`);
     });
   } catch (err) {
     logger.error("Failed to start server", { error: err.message });