feat: add cors urls env variable

[Impre-visible]

This pull request introduces updates to the CORS configuration in the backend and Docker setup to improve security and flexibility. The changes ensure that the application properly handles allowed origins for cross-origin requests.

Backend CORS Configuration Updates:

• backend/src/main.ts: Modified the origin property in the enableCors method to use a dynamic list of allowed origins, including http://localhost:5173, the value of APP_URL, and any additional origins specified in the CORS_ORIGINS environment variable.

Docker Environment Variable Addition:

• docker-compose.yml: Added a new CORS_ORIGINS environment variable to specify a comma-separated list of allowed origins for CORS, including http://localhost:5173 and https://invoicerr.example.com.

[Copilot]

Pull Request Overview

This PR enhances CORS security by replacing a permissive "allow all origins" configuration with a more restrictive allowlist approach. The changes enable dynamic configuration of allowed origins through environment variables while maintaining development and production URL support.

• Replaced permissive CORS configuration with specific allowlist-based origin checking
• Added configurable CORS_ORIGINS environment variable for additional allowed origins
• Updated Docker configuration to include default CORS origins for localhost and production

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
backend/src/main.ts	Replaced permissive CORS origin callback with allowlist array including localhost, APP_URL, and configurable CORS_ORIGINS
docker-compose.yml	Added CORS_ORIGINS environment variable with default localhost and production origins

[Copilot]

[nitpick] The complex inline array construction makes this line difficult to read and maintain. Consider extracting the origin building logic into a separate function or variable for better readability.

Suggested change

	origin: ['http://localhost:5173', process.env.APP_URL, ...(process.env.CORS_ORIGINS?.split(',').map(o => o.trim()).filter(val => !!val) || [])],
	});
	app.use(cookieParser());
	origin: getCorsOrigins(),
	});
	app.use(cookieParser());
	function getCorsOrigins(): string[] {
	const staticOrigins = ['http://localhost:5173', process.env.APP_URL];
	const dynamicOrigins = process.env.CORS_ORIGINS?.split(',')
	.map(o => o.trim())
	.filter(val => !!val) || [];
	return [...staticOrigins, ...dynamicOrigins];
	}