Function createCorsOriginChecker

backend/api/src/utils/cors.utils.ts:1–19

(allowedOrigins: string[])

export function createCorsOriginChecker(allowedOrigins: string[]) {
  return (
    origin: string | undefined,
    callback: (err: Error | null, allow?: boolean) => void,
  ) => {
    // Allow requests with no origin (like mobile apps or Postman)
    if (!origin) {
      return callback(null, true);
    }

    // Check if origin matches any allowed pattern
    if (isOriginAllowed(origin, allowedOrigins)) {
      return callback(null, true);
    }

    // Reject other origins
    callback(new Error('Not allowed by CORS'));
  };
}

export function isOriginAllowed(
  origin: string,