x

apps/backend/src/index.ts

@@ -30,6 +30,30 @@ import { mediaRoute } from "./routes/media";
 const PORT = process.env.PORT ? parseInt(process.env.PORT) : 3051;
 const CORS_ORIGIN = process.env.CORS_ORIGIN || "http://localhost:5173";
 const JWT_SECRET = process.env.JWT_SECRET || "homaroma_secret_2026_scent";
+const isDevelopment = process.env.NODE_ENV !== "production";
+
+const isPrivateLanHostname = (hostname: string) => {
+  return (
+    hostname === "localhost" ||
+    hostname === "127.0.0.1" ||
+    hostname === "0.0.0.0" ||
+    hostname === "::1" ||
+    /^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname) ||
+    /^192\.168\.\d{1,3}\.\d{1,3}$/.test(hostname) ||
+    /^172\.(1[6-9]|2\d|3[0-1])\.\d{1,3}\.\d{1,3}$/.test(hostname)
+  );
+};
+
+const allowLanDevOrigin = (request: Request) => {
+  const origin = request.headers.get("origin");
+  if (!origin) return false;
+
+  try {
+    return isPrivateLanHostname(new URL(origin).hostname);
+  } catch {
+    return false;
+  }
+};
 
 const app = new Elysia()
   .onParse(async ({ request }) => {
@@ -44,6 +68,7 @@ const app = new Elysia()
     cors({
       origin: [
         ...CORS_ORIGIN.split(",").map((o) => o.trim()),
+        ...(isDevelopment ? [allowLanDevOrigin] : []),
         "https://admin.homaroma.shop",
         "https://spa.homaroma.shop", // LIFF (SPA)
         "https://homaroma.shop",      // Main Website