kenneth 464cbe4fa3 fix: gate permissive CORS to dev only ...

In production, only origins listed in CORS_ORIGINS env
var are allowed. In dev, any origin is reflected back.

Co-authored-by: Ona <no-reply@ona.com>

2026-03-23 00:31:06 +00:00

..

admin

feat(session): query enabled sources before providers (#85)

2026-03-22 16:28:19 +00:00

auth

fix(backend): add CORS middleware and disable CSRF in dev

2026-03-23 00:22:36 +00:00

db

feat(backend): add admin plugin and create-admin script (#80)

2026-03-16 22:39:40 +00:00

engine

feat(session): query enabled sources before providers (#85)

2026-03-22 16:28:19 +00:00

enhancement

fix(backend): disable reasoning and fallback to reasoning field (#90)

2026-03-22 22:47:01 +00:00

lib

feat(backend): add DB persistence layer (#79)

2026-03-16 01:30:02 +00:00

location

feat(session): query enabled sources before providers (#85)

2026-03-22 16:28:19 +00:00

scripts

feat(backend): add admin plugin and create-admin script (#80)

2026-03-16 22:39:40 +00:00

session

fix(backend): reject unknown fields in source config (#88)

2026-03-22 22:45:17 +00:00

sources

fix(backend): reject unknown fields in source config (#88)

2026-03-22 22:45:17 +00:00

tfl

fix(backend): reject unknown fields in source config (#88)

2026-03-22 22:45:17 +00:00

weather

fix(backend): reject unknown fields in source config (#88)

2026-03-22 22:45:17 +00:00

server.ts

fix: gate permissive CORS to dev only

2026-03-23 00:31:06 +00:00