KC-APP-Server/src/main.ts

import { NestFactory } from '@nestjs/core';
import { ValidationPipe } from '@nestjs/common';
import { WsAdapter } from '@nestjs/platform-ws';
import { AppModule } from './app.module';

function parseAllowedOrigins(): string[] {
  const envOrigins = process.env.ALLOWED_ORIGINS || process.env.CORS_ORIGIN;
  if (envOrigins) {
    return envOrigins
      .split(',')
      .map((o) => o.trim())
      .filter(Boolean);
  }

  const defaultOrigins: string[] = [
    'http://localhost:3000',
    'http://localhost:3010',
    'http://localhost:8080',
    'http://127.0.0.1:3000',
    'http://127.0.0.1:3010',
    'http://127.0.0.1:8080',
  ];

  if (process.env.APP_BASE_URL) {
    try {
      const parsed = new URL(process.env.APP_BASE_URL);
      if (!defaultOrigins.includes(parsed.origin)) {
        defaultOrigins.push(parsed.origin);
      }
    } catch {
      const trimmed = process.env.APP_BASE_URL.trim();
      if (!defaultOrigins.includes(trimmed)) {
        defaultOrigins.push(trimmed);
      }
    }
  }

  return defaultOrigins;
}

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.setGlobalPrefix('api');
  app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));

  const allowedOrigins = parseAllowedOrigins();
  app.enableCors({
    origin: (origin, callback) => {
      // Allow requests with no origin (e.g. mobile apps, curl, same-origin)
      if (!origin || allowedOrigins.includes(origin)) {
        callback(null, true);
      } else {
        callback(new Error('Not allowed by CORS'));
      }
    },
    credentials: true,
  });

  app.useWebSocketAdapter(new WsAdapter(app));
  await app.listen(process.env.PORT ?? 3000);
}
bootstrap();