Restrict CORS to allowed origins

[overcut-ai]

Overall goal

Restrict Cross-Origin Resource Sharing (CORS) so that only explicitly allowed origins can access the Hotel-Management-Service API, closing security gap identified in #83.

Checklist

• Bootstrap update in main.ts – removed { cors: true }, added app.enableCors() with env-driven allow-list.
• Added .env.example – introduces CORS_ALLOWED_ORIGINS variable template.
• Added lint:cors script guard – fails CI if permissive CORS snippet re-appears.
• Updated README documentation – documents new variable and default behaviour.

Follow-up notes for reviewers

• Default allow-list includes http://localhost:3000 and http://localhost:4200 for local development.
• Remember to set CORS_ALLOWED_ORIGINS in each deployment environment to the production origins expected by clients.

Closes #83.

[overcut-ai]

Completed Working on "Code Review v2.0"

✅ Code review comments from chunk processed and review submitted with REQUEST_CHANGES. Posted 4 comments across 3 files highlighting major security and robustness issues and provided remediation suggestions. Next steps communicated to author.

---

👉 View complete log

[overcut-ai]

Security tightening is welcome, but several blockers remain:

1. Example environment file may leak open localhost origins in production—comment out defaults.
2. main.ts: CORS allow-list parsing fails when CORS_ALLOWED_ORIGINS is set but empty; filter out blank values and retain sane defaults.
3. No automated tests cover the new CORS logic; add integration tests to ensure disallowed origins are rejected and wildcard * cannot be re-enabled.
4. lint:cors grep pattern is brittle; variants like {cors: true} or double-quoted keys bypass the check—use a more flexible regex and broader path scope.

Please address these issues before merging.

[overcut-ai]

Including active localhost origins in the example file may lead teams to copy the value unmodified into production, unintentionally exposing the API. Consider commenting this line out and providing it as guidance instead, e.g. # CORS_ALLOWED_ORIGINS=http://example.com, so production environments start locked-down by default.

[overcut-ai]

If CORS_ALLOWED_ORIGINS is defined but empty (e.g. CORS_ALLOWED_ORIGINS=""), .split(',') returns ["" ], so the fallback list is skipped and Nest will reply with Access-Control-Allow-Origin: null, effectively blocking all browsers. Please trim & filter falsy entries and fall back to the defaults when the resulting list is empty.

[overcut-ai]

Security-critical behaviour changed, but no automated test verifies that disallowed origins are rejected or that wildcards are never re-enabled. Please add an integration test that spins up the app with/without CORS_ALLOWED_ORIGINS and asserts the Access-Control-Allow-Origin header for allowed vs disallowed origins.

[overcut-ai]

The grep guard is fragile: it matches only the exact substring with spaces/braces, so variants like {cors: true}, double quotes, or usages in other files could bypass CI. Use a more flexible regex such as grep -R --line-number -E '\{\s*cors\s*:\s*true' apps/**/*.ts to prevent false negatives.

[overcut-ai]

Completed Working on "Auto-Changelog Reminder"

✅ Analyzed PR #87: detected user-facing CORS behaviour change with no changelog update. Suggested appropriate entry and commented on PR requesting addition, offering to commit upon "approve changelog" reply.

---

👉 View complete log

[overcut-ai]

⚠️ A changelog entry is required for user-facing changes.

It looks like this PR introduces user-facing behaviour changes (CORS restrictions) but no CHANGELOG.md update was found.

Here’s a suggested entry you can copy-paste (a root-level CHANGELOG.md does not yet exist, so please add it or update your preferred changelog file):

## [Unreleased]
### Changed
- Restrict CORS: the Hotel-Management-Service server now allows only the origins listed in the `CORS_ALLOWED_ORIGINS` environment variable, replacing the previous permissive `*` policy.

Reply with "approve changelog" and I will create a commit on this PR with the suggested entry.