From 1233f15b918644e81c014f19fbb8ded640d65314 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@litecharms.co.za>
Date: Sat, 24 Oct 2026 14:58:55 +0200
Subject: [PATCH] Applied CORS fix

---
 PostFundManagement.Api/Program.cs | 26 +++++++++++++++++++++++++-
 docker-compose.yml                |  1 +
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/PostFundManagement.Api/Program.cs b/PostFundManagement.Api/Program.cs
index dbac407..c75e660 100644
--- a/PostFundManagement.Api/Program.cs
+++ b/PostFundManagement.Api/Program.cs
@@ -116,7 +116,30 @@ builder.Services.AddCors(options =>
 {
     options.AddPolicy(CorsPolicy, policy =>
     {
-        policy.WithOrigins(allowedOrigins)
+        policy.SetIsOriginAllowed(origin =>
+              {
+                  if (string.IsNullOrWhiteSpace(origin)) return false;
+                  var clean = origin.TrimEnd('/');
+                  if (allowedOrigins.Any(a => string.Equals(a.TrimEnd('/'), clean, StringComparison.OrdinalIgnoreCase)))
+                      return true;
+
+                  try
+                  {
+                      var host = new Uri(origin).Host;
+                      if (host.EndsWith("khongisa.co.za", StringComparison.OrdinalIgnoreCase) ||
+                          host.Equals("localhost", StringComparison.OrdinalIgnoreCase) ||
+                          host.Equals("127.0.0.1", StringComparison.OrdinalIgnoreCase))
+                      {
+                          return true;
+                      }
+                  }
+                  catch
+                  {
+                      // ignore parse failure
+                  }
+
+                  return false;
+              })
               .AllowAnyHeader()
               .AllowAnyMethod()
               .AllowCredentials();
@@ -131,6 +154,7 @@ var scheduler = await schedulerFactory.GetScheduler();
 if (scheduler!.Status != SchedulerStatus.Running)
     await scheduler.Start();
 
+app.UseCors(CorsPolicy);
 app.UseHsts();
 app.UseHttpsRedirection();
 app.UseRouting();
diff --git a/docker-compose.yml b/docker-compose.yml
index 0016acd..9499da8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -22,6 +22,7 @@ services:
       - CorsOrigins__0=${CORS_ORIGIN_CONSOLE:-https://console.ifri.khongisa.co.za}
       - CorsOrigins__1=${CORS_ORIGIN_API:-https://api.ifri.khongisa.co.za}
       - CorsOrigins__2=${CORS_ORIGIN_LOCAL:-https://localhost:7208}
+      - CorsOrigins__3=${CORS_ORIGIN_PARTNER:-https://partner.ifri.khongisa.co.za}
       
       # Postgres Database Overrides      
       - ConnectionStrings__PfmDatabase=Server=${POSTGRES_HOST:-192.168.1.170};Port=${POSTGRES_PORT:-5432};Database=${POSTGRES_DB:-pfm};User Id=${POSTGRES_USER:-pfm-user};Password=${POSTGRES_PASSWORD:-};