Merge pull request #73 from atlp-rwanda/fx-socket

socket fix

src/utils/env.ts

@@ -17,6 +17,9 @@ export const env = {
   local_url: `${process.env.LOCAL_URL}:${process.env.PORT}/api/v1/users/2fa-verify`,
   redis_url: process.env.REDIS_URL as string,
   client_url: process.env.CLIENT_URL as string,
+  client_url2: process.env.CLIENT_URL2 as string,
+  client_url3: process.env.CLIENT_URL3 as string,
+  client_url4: process.env.CLIENT_URL4 as string,
   stripe_secret: process.env.STRIPE_SECRET_KEY as string,
   password_expiration_time: process.env.TIME_FOR_PASSWORD_EXPIRATION as string,
   ADS_URL: process.env.ADS_URL as String

src/utils/server.ts

@@ -19,13 +19,24 @@ import { findExpiredProduct } from "../jobs/cron";
 import { env } from "./env";
 
 const app = express();
-const isDevelopment = process.env.NODE_ENV === 'development';
-const origin = isDevelopment ? "http://localhost:3000" : "https://eagles-ec-be-development.onrender.com";
+
+const allowedOrigins = [
+  env.client_url,
+  env.client_url2,
+  env.client_url3,
+  env.client_url4
+]
 
 const server: HTTPServer = createServer(app);
 export const io: SocketIOServer = new SocketIOServer(server, {
   cors: {
-    origin: origin,
+    origin: (origin, callback) => {
+      if (!origin || allowedOrigins.includes(origin)) {
+        callback(null, true);
+      } else {
+        callback(new Error("Not allowed by CORS"));
+      }
+    },
     methods: ["GET", "POST"],
     allowedHeaders: ["Origin", "X-Requested-With", "Content-Type", "Accept"],
     credentials: true,