[FEAT] Per-Merchant CORS Origin Configuration

[oomokaro1]

[FEAT] Per-Merchant CORS Origin Configuration

Priority: Medium

Difficulty: Medium
Estimated Effort: 1-2 days
Relevant Packages: OrbitStream_backend/, orbitstream_docs/
Labels: enhancement, security, priority:medium

Requirements

1. Merchant Origin Storage

• Add cors_origins JSONB column to merchants table
• Store array of allowed origins: ["https://myshop.com", "https://staging.myshop.com"]
• Maximum 10 origins per merchant

2. Origin CRUD API

• GET /merchants/me/cors — list configured origins (JWT auth)
• PUT /merchants/me/cors — set origins (JWT auth)
  • Body: { "origins": ["https://example.com"] }
  • Validate each origin is a valid URL with https scheme
  • Maximum 10 origins
• DELETE /merchants/me/cors/:origin — remove a specific origin

3. CORS Middleware Integration

• The dynamic CORS middleware checks the merchant's configured origins
• For checkout session endpoints (/v1/checkout/sessions/:id), allow the merchant's configured origins
• Cache merchant origins in Redis (5-minute TTL)

4. Validation

• Only HTTPS origins allowed in production
• No wildcards (*) allowed
• No localhost in production
• Maximum 10 origins per merchant
• Each origin must be a valid URL

5. Testing

• Unit test: origin validation (valid, invalid, localhost in prod)
• Unit test: maximum origins enforced
• Integration test: request from merchant's configured origin succeeds
• Integration test: request from unconfigured origin is rejected

[Jaydbrown]

Went through the merchants module before commenting. The cors_origins column is already in the schema, and GET /me/cors and PUT /me/cors are implemented. Redis caching and the dynamic middleware are also done.

What's missing: SetCorsOriginsDto only has @IsArray() and a basic @IsUrl() — no max size, no HTTPS enforcement, no localhost blocking, no wildcard check. And there's no DELETE /me/cors/:origin endpoint.

DTO fix:

export class SetCorsOriginsDto {
  @IsArray()
  @ArrayMaxSize(10, { message: 'Maximum 10 origins allowed' })
  @IsUrl(
    { protocols: ['https'], require_protocol: true, allow_localhost: false },
    { each: true },
  )
  @Matches(/^[^*]+$/, { each: true, message: 'Wildcard origins are not permitted' })
  origins: string[];
}

For DELETE, I'd add a deleteCorsOrigin(merchantId, origin) method that filters the stored array and delegates to setCorsOrigins — which already handles cache invalidation — then wire it up in the controller. Straightforward change. Happy to take this.

[grantfox-oss]

🦊 GrantFox — @Jaydbrown has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #19)
2. Your PR will be reviewed by the OrbitStream maintainers

Good luck! Track your progress on GrantFox.