From b8eaebaa5c38d2188d44cfb6b98c13775f06888c Mon Sep 17 00:00:00 2001
From: scanash00 <scan@scanash.com>
Date: Sun, 1 Mar 2026 00:28:35 -0900
Subject: [PATCH] fun

---
 backend/cmd/server/main.go | 21 ++++++++++++++++++++-
 web/src/middleware.ts      | 21 ++++++++++++++++++++-
 2 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/backend/cmd/server/main.go b/backend/cmd/server/main.go
index fa7b912..ffde06c 100644
--- a/backend/cmd/server/main.go
+++ b/backend/cmd/server/main.go
@@ -6,6 +6,7 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
+	"strings"
 	"syscall"
 	"time"
 
@@ -62,7 +63,25 @@ func main() {
 	r.Use(middleware.Throttle(100))
 
 	r.Use(cors.Handler(cors.Options{
-		AllowedOrigins:   []string{"https://*", "http://*", "chrome-extension://*"},
+		AllowOriginFunc: func(r *http.Request, origin string) bool {
+			if strings.HasPrefix(origin, "chrome-extension://") ||
+				strings.HasPrefix(origin, "moz-extension://") ||
+				strings.HasPrefix(origin, "safari-web-extension://") {
+				return true
+			}
+			allowedOrigins := []string{
+				"https://margin.at",
+				"https://www.margin.at",
+				"http://localhost:4321",
+				"http://localhost:8081",
+			}
+			for _, allowed := range allowedOrigins {
+				if origin == allowed {
+					return true
+				}
+			}
+			return false
+		},
 		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
 		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token", "X-Session-Token"},
 		ExposedHeaders:   []string{"Link"},
diff --git a/web/src/middleware.ts b/web/src/middleware.ts
index 76de07b..280f117 100644
--- a/web/src/middleware.ts
+++ b/web/src/middleware.ts
@@ -41,10 +41,29 @@ export async function onRequest(
 
   try {
     const res = await fetch(target.toString(), init);
+    const responseHeaders = new Headers(res.headers);
+
+    const origin = request.headers.get("origin");
+    if (origin && (
+      origin.startsWith("chrome-extension://") ||
+      origin.startsWith("moz-extension://") ||
+      origin.startsWith("safari-web-extension://")
+    )) {
+      responseHeaders.set("Access-Control-Allow-Origin", origin);
+      responseHeaders.set("Access-Control-Allow-Credentials", "true");
+      responseHeaders.set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
+      responseHeaders.set("Access-Control-Allow-Headers", "Accept, Authorization, Content-Type, X-CSRF-Token, X-Session-Token");
+      responseHeaders.set("Access-Control-Expose-Headers", "Link");
+    }
+
+    if (request.method === "OPTIONS" && origin) {
+      return new Response(null, { status: 204, headers: responseHeaders });
+    }
+
     return new Response(res.body, {
       status: res.status,
       statusText: res.statusText,
-      headers: res.headers,
+      headers: responseHeaders,
     });
   } catch {
     return new Response("Backend unavailable", { status: 502 });
-- 
2.51.2