From 85454610f4ad8f098646b19c69408f469b20f668 Mon Sep 17 00:00:00 2001
From: zwitschi <zwitschi82@gmail.com>
Date: Sun, 16 Aug 2026 09:41:06 +0200
Subject: [PATCH] fix(infrastructure): add dynamic CORS origin mapping and
 preflight handling for admin API endpoints

---
 infrastructure/nginx/nginx.conf | 58 +++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/infrastructure/nginx/nginx.conf b/infrastructure/nginx/nginx.conf
index 8c26483..e906195 100644
--- a/infrastructure/nginx/nginx.conf
+++ b/infrastructure/nginx/nginx.conf
@@ -13,6 +13,14 @@ http {
         '' close;
     }
 
+    map $http_origin $cors_origin {
+        default "";
+        "https://linearvoid.tv"                              $http_origin;
+        "https://www.linearvoid.tv"                          $http_origin;
+        "https://linearvoid-frontend.zwitschi82.workers.dev" $http_origin;
+        "~^https://[a-zA-Z0-9.-]+\.linearvoid\.tv$"          $http_origin;
+    }
+
     server {
         listen 80;
         server_name www.linearvoid.tv;
@@ -85,6 +93,14 @@ http {
         }
 
         location = /api/admin/login {
+            if ($request_method = OPTIONS) {
+                add_header Access-Control-Allow-Origin $cors_origin;
+                add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
+                add_header Access-Control-Allow-Headers "Content-Type, Authorization";
+                add_header Access-Control-Allow-Credentials true;
+                add_header Access-Control-Max-Age 86400;
+                return 204;
+            }
             set $chat_upstream http://chat:3000;
             proxy_pass $chat_upstream;
             proxy_http_version 1.1;
@@ -93,9 +109,19 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header Cookie $http_cookie;
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Credentials true always;
         }
 
         location = /api/admin/logout {
+            if ($request_method = OPTIONS) {
+                add_header Access-Control-Allow-Origin $cors_origin;
+                add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
+                add_header Access-Control-Allow-Headers "Content-Type, Authorization";
+                add_header Access-Control-Allow-Credentials true;
+                add_header Access-Control-Max-Age 86400;
+                return 204;
+            }
             set $chat_upstream http://chat:3000;
             proxy_pass $chat_upstream;
             proxy_http_version 1.1;
@@ -104,9 +130,19 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header Cookie $http_cookie;
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Credentials true always;
         }
 
         location = /api/admin/session {
+            if ($request_method = OPTIONS) {
+                add_header Access-Control-Allow-Origin $cors_origin;
+                add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
+                add_header Access-Control-Allow-Headers "Content-Type, Authorization";
+                add_header Access-Control-Allow-Credentials true;
+                add_header Access-Control-Max-Age 86400;
+                return 204;
+            }
             set $chat_upstream http://chat:3000;
             proxy_pass $chat_upstream;
             proxy_http_version 1.1;
@@ -115,9 +151,19 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header Cookie $http_cookie;
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Credentials true always;
         }
 
         location /api/admin/ {
+            if ($request_method = OPTIONS) {
+                add_header Access-Control-Allow-Origin $cors_origin;
+                add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
+                add_header Access-Control-Allow-Headers "Content-Type, Authorization";
+                add_header Access-Control-Allow-Credentials true;
+                add_header Access-Control-Max-Age 86400;
+                return 204;
+            }
             auth_request /_admin_auth;
             error_page 401 = @admin_api_unauthorized;
             set $chat_upstream http://chat:3000;
@@ -128,9 +174,19 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header Cookie $http_cookie;
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Credentials true always;
         }
 
         location /api/ {
+            if ($request_method = OPTIONS) {
+                add_header Access-Control-Allow-Origin $cors_origin;
+                add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
+                add_header Access-Control-Allow-Headers "Content-Type, Authorization";
+                add_header Access-Control-Allow-Credentials true;
+                add_header Access-Control-Max-Age 86400;
+                return 204;
+            }
             set $chat_upstream http://chat:3000;
             proxy_pass $chat_upstream;
             proxy_http_version 1.1;
@@ -138,6 +194,8 @@ http {
             proxy_set_header X-Forwarded-Host $host;
             proxy_set_header X-Forwarded-Proto $scheme;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Credentials true always;
         }
 
         location = /metrics {