From b239c402fa7c6b91940a70669bd39ad7a69b2140 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@litecharms.co.za>
Date: Tue, 15 Sep 2026 07:29:58 +0200
Subject: [PATCH] Applied configurable CORS policy to API

---
 PostFundManagement.Api/Program.cs       | 17 +++++++++++++++--
 PostFundManagement.Api/appsettings.json |  4 ++++
 docker-compose.yml                      |  5 +++++
 3 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/PostFundManagement.Api/Program.cs b/PostFundManagement.Api/Program.cs
index 3c4bc60..44f1567 100644
--- a/PostFundManagement.Api/Program.cs
+++ b/PostFundManagement.Api/Program.cs
@@ -91,6 +91,19 @@ builder.Services.AddOpenApi(options =>
     });
 });
 
+var allowedOrigins = builder.Configuration.GetSection("CorsOrigins").Get<string[]>() ?? [];
+
+builder.Services.AddCors(options =>
+{
+    options.AddPolicy("AllowConfiguredOrigins", policy =>
+    {
+        policy.WithOrigins(allowedOrigins)
+              .AllowAnyHeader()
+              .AllowAnyMethod()
+              .AllowCredentials();
+    });
+});
+
 var app = builder.Build();
 
 var schedulerFactory = app.Services.GetRequiredService<ISchedulerFactory>();
@@ -101,10 +114,10 @@ if (!scheduler!.IsStarted)
 
 app.UseHsts();
 app.UseHttpsRedirection();
-
 app.UseRouting();
-
+app.UseCors("AllowConfiguredOrigins");
 app.UseOutputCache();
+
 app.UseAuthentication();
 app.UseAuthorization();
 
diff --git a/PostFundManagement.Api/appsettings.json b/PostFundManagement.Api/appsettings.json
index 9add939..ca06352 100644
--- a/PostFundManagement.Api/appsettings.json
+++ b/PostFundManagement.Api/appsettings.json
@@ -1,4 +1,8 @@
 {
+  "CorsOrigins": [
+    "https://console.ifri.khongisa.co.za",
+    "https://localhost:7208"
+  ],
   "GeneralS3Settings": {
     "ServiceUrl": "https://s3.garage.khongisa.co.za",
     "Region": "garage",
diff --git a/docker-compose.yml b/docker-compose.yml
index 35fa588..4ca2af3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -13,6 +13,11 @@ services:
       - ForwardedHeadersConfiguration__Enabled=true
       - ForwardedHeadersConfiguration__AllowAll=true
       - ForwardedHeadersConfiguration__ForwardLimit=1
+
+      # CORS Overrides
+      - CorsOrigins__0=${CORS_ORIGIN_CONSOLE:-https://console.ifri.khongisa.co.za}
+      - CorsOrigins__1=${CORS_ORIGIN_API:-https://api.ifri.khongisa.co.za}
+      - CorsOrigins__2=${CORS_ORIGIN_LOCAL:-https://localhost:7208}
       
       # Postgres Database Overrides      
       - ConnectionStrings__PfmDatabase=Server=${POSTGRES_HOST:-192.168.1.170};Port=${POSTGRES_PORT:-5432};Database=${POSTGRES_DB:-pfm};User Id=${POSTGRES_USER:-pfm-user};Password=${POSTGRES_PASSWORD};
-- 
2.47.3