Develop (#7)

* here we go.........

* updated swagger docs

* chore(push): 0.3.0

* feat(hmm): update changelog date

* feat(add): github stuff

* feat(add): cors fix

* Remove AllowCredentials from CORS settings

Removed AllowCredentials setting from CORS configuration.

* chore: run code formatter

* fix: cors origins parsing issue

Author: CodeMeAPixel

.gitignore

@@ -49,3 +49,7 @@ logs/
 tmp/
 temp/
 *.tmp
+
+db
+migrate
+

.golangci.yml

@@ -1,14 +1,10 @@
 run:
   timeout: 5m
   tests: true
-  skip-dirs:
-    - vendor
-    - bin
   go: '1.24'
 
 linters:
   enable:
-    - aconv
     - asciicheck
     - bidichk
     - bodyclose
@@ -26,7 +22,6 @@ linters:
     - forbidigo
     - forcetypeassert
     - funlen
-    - gocheckcompileerrors
     - gochecksumtype
     - gocritic
     - gocyclo
@@ -59,7 +54,6 @@ linters:
     - mnd
     - musttag
     - nakedret
-    - nargout
     - nestif
     - nilerr
     - nilnil
@@ -78,14 +72,9 @@ linters:
     - reassign
     - revive
     - rowserrcheck
-    - rowsclose
     - sloglint
-    - slurp
     - spancheck
-    - sqlc
     - staticcheck
-    - stdlibuserspace
-    - strconcat
     - tagalign
     - tagliatelle
     - tenv
@@ -95,10 +84,7 @@ linters:
     - tparallel
     - typecheck
     - unconvert
-    - undeclaredname
     - unparam
-    - unsafeptr
-    - unusedvars
     - usestdlibvars
     - wastedassign
     - whitespace
@@ -124,7 +110,7 @@ linters-settings:
     min-complexity: 10
 
   govet:
-    check-shadowing: true
+    disable-all: false
 
   lll:
     line-length: 120
@@ -148,14 +134,14 @@ linters-settings:
       - name: unused-parameter
       - name: unused-receiver
 
-  staticcheck:
-    go: '1.24'
-  
   unparam:
     check-exported: false
 
 issues:
   exclude-use-default: false
+  exclude-dirs:
+    - vendor
+    - bin
   exclude:
     # G101 is about environment variable handling
     - G101

cmd/api/main.go

@@ -22,6 +22,7 @@ import (
 	"context"
 	"os"
 	"os/signal"
+	"strings"
 	"syscall"
 	"time"
 
@@ -221,9 +222,10 @@ func setupMiddleware(app *fiber.App, sentryHandler fiber.Handler, cfg *config.Co
 		Format: "[${time}] ${status} - ${latency} ${method} ${path}\n",
 	}))
 	app.Use(cors.New(cors.Config{
-		AllowOrigins:     cfg.CORSOrigins,
+		AllowOrigins:     strings.Join(cfg.CORSOrigins, ","),
 		AllowHeaders:     "Origin, Content-Type, Accept, Authorization, X-API-Key",
 		AllowMethods:     "GET, POST, PUT, DELETE, OPTIONS, PATCH",
+		AllowCredentials: true,
 	}))
 }
 

db

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"os"
 	"strconv"
+	"strings"
 
 	"github.com/nodebyte/backend/internal/crypto"
 	"github.com/nodebyte/backend/internal/database"
@@ -27,7 +28,7 @@ type Config struct {
 	APIKey string
 
 	// CORS
-	CORSOrigins string
+	CORSOrigins []string
 
 	// Pterodactyl Panel
 	PterodactylURL          string
@@ -68,7 +69,7 @@ func Load() (*Config, error) {
 		DatabaseURL: os.Getenv("DATABASE_URL"),
 		RedisURL:    getEnv("REDIS_URL", "localhost:6379"),
 		APIKey:      os.Getenv("BACKEND_API_KEY"),
-		CORSOrigins: getEnv("CORS_ORIGINS", "*"),
+		CORSOrigins: parseCORSOrigins(getEnv("CORS_ORIGINS", "https://nodebyte.host")),
 
 		// Panel settings
 		PterodactylURL:          os.Getenv("PTERODACTYL_URL"),
@@ -131,6 +132,16 @@ func getEnvBool(key string, defaultValue bool) bool {
 	return defaultValue
 }
 
+func parseCORSOrigins(originsStr string) []string {
+	var origins []string
+	for _, origin := range strings.Split(originsStr, ",") {
+		if trimmed := strings.TrimSpace(origin); trimmed != "" {
+			origins = append(origins, trimmed)
+		}
+	}
+	return origins
+}
+
 // MergeFromDB loads configuration overrides from the `config` table in the
 // main application database. Values stored in the DB will overwrite the
 // corresponding fields on the provided Config when present.

internal/config/config.go

@@ -99,7 +99,9 @@ func TestLoad(t *testing.T) {
 			},
 			expectErr: false,
 			checkFn: func(cfg *Config) bool {
-				return cfg.CORSOrigins == "https://example.com,https://app.example.com"
+				return len(cfg.CORSOrigins) == 2 &&
+					cfg.CORSOrigins[0] == "https://example.com" &&
+					cfg.CORSOrigins[1] == "https://app.example.com"
 			},
 		},
 		{