Allowed "*" as a CORS_DOMAINS entry which overrides the cors middleware

Backend/src/index.ts

@@ -29,9 +29,16 @@ export const PORT = env.PORT;
 
 export { prisma };
 
-const CORS_DOMAINS = env.CORS_URLS.split(",").map((s) => s.trim());
+let CORS_DOMAINS = env.CORS_URLS.split(",").map((s) => s.trim());
 CORS_DOMAINS.push(UI_URL);
 CORS_DOMAINS.push(REACT_APP_API_URL.replace(/\/+$/, ""));
+
+// If an origin is "*", clear the list and add a star
+// ? This is for PR-Previews especially, which have a dynamic origin and cannot be enumerated in advance
+if (CORS_DOMAINS.includes("*")) {
+	CORS_DOMAINS = ["*"];
+}
+
 initCorsDomains(CORS_DOMAINS);
 
 if (env.NODE_ENV !== "test") {

Backend/src/lib/middlewares/cors.ts

@@ -29,6 +29,26 @@ export const corsMiddleware = new Middleware<{}, {}>("Custom CORS", "1.0.0")
 
 		const origin = ctr.headers.get("origin");
 
+		// if the list is only a single star, allow all origins
+		if (CORS_DOMAINS.length === 1 && CORS_DOMAINS[0] === "*") {
+			if (origin) {
+				ctr.headers.set("Access-Control-Allow-Origin", origin);
+				ctr.headers.set("Vary", "Origin");
+				ctr.headers.set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS, PATCH");
+				ctr.headers.set(
+					"Access-Control-Allow-Headers",
+					ctr.headers.get("access-control-request-headers") || "content-type, x-api-key",
+				);
+				ctr.headers.set("Access-Control-Allow-Credentials", "true");
+			}
+			if (ctr.url.method === "OPTIONS") {
+				ctr.headers.set("Access-Control-Max-Age", "86400");
+				ctr.headers.set("Content-Length", "0");
+				return end(ctr.status(ctr.$status.NO_CONTENT).print(""));
+			}
+			return;
+		}
+
 		if (origin && !CORS_DOMAINS.includes(origin)) {
 			// Agent/API traffic (no browser origin) is unaffected; only browser
 			// requests from disallowed origins are blocked.