From 715f870b32d7b1a68b655aaa506a55e0e1123e1d Mon Sep 17 00:00:00 2001
From: Xin Feng <126309503+danielxfeng@users.noreply.github.com>
Date: Sun, 11 Jan 2026 14:16:26 +0200
Subject: [PATCH] fix/backend: for cors: allow localhost and vercel

---
 backend/cmd/server/main.go | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/backend/cmd/server/main.go b/backend/cmd/server/main.go
index 7027aae..e1b550c 100644
--- a/backend/cmd/server/main.go
+++ b/backend/cmd/server/main.go
@@ -3,6 +3,7 @@ package main
 import (
 	"net/http"
 	"os"
+	"strings"
 	"time"
 
 	swaggerfiles "github.com/swaggo/files"
@@ -35,12 +36,17 @@ func SetupRouter(logger *slog.Logger) *gin.Engine {
 		ServerErrorLevel: slog.LevelError,
 	}
 
+	// A rough CORS
 	r.Use(cors.New(cors.Config{
-		AllowOrigins: []string{
-			"http://localhost:5173",
-			"http://localhost:4173",
-			"https://localhost:5173",
-			"https://c2r5p11.hive.fi:5173",
+		AllowOriginFunc: func(origin string) bool {
+			if origin == "http://localhost:5173" ||
+				origin == "http://localhost:4173" {
+				return true
+			}
+			if strings.HasSuffix(origin, ".vercel.app") {
+				return true
+			}
+			return false
 		},
 		AllowMethods:     []string{"GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"},
 		AllowHeaders:     []string{"Origin", "Content-Length", "Content-Type", "Authorization"},