From 5a5312097db1205480142ae41e41ace60fb3774d Mon Sep 17 00:00:00 2001
From: GnomeZworc <nicolas.boufidjeline@g3e.fr>
Date: Sun, 14 Jun 2026 22:29:22 +0200
Subject: [PATCH] add cors handle

Signed-off-by: GnomeZworc <nicolas.boufidjeline@g3e.fr>
---
 internal/config/config.go |  4 +++-
 internal/server/server.go | 50 ++++++++++++++++++++++++++++++++++-----
 2 files changed, 47 insertions(+), 7 deletions(-)

diff --git a/internal/config/config.go b/internal/config/config.go
index b187f27..f4340b8 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -14,7 +14,8 @@ type Config struct {
 	CoinGeckoKey         string
 	PriceFetchInterval   time.Duration
 	PriceCleanInterval   time.Duration
-	SnapshotHorizonDays  int // nombre de jours dans le futur couverts par les snapshots
+	SnapshotHorizonDays  int
+	CORSAllowedOrigins   string // "*" ou liste comma-séparée d'origines
 }
 
 func Load() *Config {
@@ -37,6 +38,7 @@ func Load() *Config {
 		PriceFetchInterval:  fetchInterval,
 		PriceCleanInterval:  24 * time.Hour,
 		SnapshotHorizonDays: horizonDays,
+		CORSAllowedOrigins:  getenv("CORS_ALLOWED_ORIGINS", "*"),
 	}
 }
 
diff --git a/internal/server/server.go b/internal/server/server.go
index 805320a..fa2ae22 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"log/slog"
 	"net/http"
+	"strings"
 
 	"git.g3e.fr/H6N/account/internal/auth"
 	"git.g3e.fr/H6N/account/internal/config"
@@ -33,12 +34,49 @@ func New(cfg *config.Config, pool *pgxpool.Pool, logger *slog.Logger) *Server {
 }
 
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	// /health est exempt d'auth. Toutes les autres routes passent par le middleware owner.
-	if r.URL.Path == "/health" {
-		s.mux.ServeHTTP(w, r)
-		return
-	}
-	auth.Middleware(s.mux).ServeHTTP(w, r)
+	s.corsMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/health" {
+			s.mux.ServeHTTP(w, r)
+			return
+		}
+		auth.Middleware(s.mux).ServeHTTP(w, r)
+	})).ServeHTTP(w, r)
+}
+
+func (s *Server) corsMiddleware(next http.Handler) http.Handler {
+	allowedOrigins := strings.Split(s.cfg.CORSAllowedOrigins, ",")
+	wildcard := len(allowedOrigins) == 1 && strings.TrimSpace(allowedOrigins[0]) == "*"
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		origin := r.Header.Get("Origin")
+		if origin != "" {
+			allowed := wildcard
+			if !allowed {
+				for _, o := range allowedOrigins {
+					if strings.TrimSpace(o) == origin {
+						allowed = true
+						break
+					}
+				}
+			}
+			if allowed {
+				if wildcard {
+					w.Header().Set("Access-Control-Allow-Origin", "*")
+				} else {
+					w.Header().Set("Access-Control-Allow-Origin", origin)
+					w.Header().Add("Vary", "Origin")
+				}
+				w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
+				w.Header().Set("Access-Control-Allow-Headers", "Content-Type, X-Owner-ID")
+				w.Header().Set("Access-Control-Max-Age", "86400")
+			}
+		}
+		if r.Method == http.MethodOptions {
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
 }
 
 func (s *Server) routes() {