tajniak81andClaude Opus 4.8
98acd7d121
Mirror the PocketBase settings card with a superadmin-only Web App section: it edits the Web App base URL (the address /api/status already probed) and the CORS allowed origins, applying both at runtime and persisting them to .env so they survive a restart. The CORS middleware previously built its allow-list once, when Handler() was constructed, so an edited origin list would not have taken effect until a restart — which would have made the new field quietly lie. Move the lookup into a per-request originAllowed helper reading under the existing lock. Verified behaviour is unchanged: an allowed origin still gets the headers plus Vary: Origin, an unknown origin gets none, and preflight still returns 204. PUT rejects an empty origin list rather than silently keeping the old one, since an empty list would lock out every browser client. The authenticated round trip (loading and saving real settings) is not verified here — it needs a superadmin login. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
40 lines
1.8 KiB
Bash
40 lines
1.8 KiB
Bash
# API Server configuration
|
|
# Copy to .env and adjust. The server also reads plain environment variables.
|
|
# Never commit the real .env file.
|
|
|
|
# Address the API Server listens on. A bare port (8080) is accepted too.
|
|
API_ADDR=:8080
|
|
|
|
# PocketBase base URL (no trailing slash). The API Server is the only thing that
|
|
# talks to PocketBase; it proxies /api/auth/* to this address, which is never
|
|
# exposed to clients. Editable at runtime from the panel (PocketBase section),
|
|
# which writes the change back into this file.
|
|
POCKETBASE_URL=http://10.2.1.10:8027
|
|
|
|
# PocketBase superuser service account. Every privileged flow runs through it:
|
|
# user/organization management and all car-domain database access. Leave unset
|
|
# and the server still starts — a superadmin can log in to the panel and
|
|
# configure it there; management endpoints return 503 until then.
|
|
POCKETBASE_ADMIN_EMAIL=
|
|
POCKETBASE_ADMIN_PASSWORD=
|
|
|
|
# CORS allowed origins for browser clients (comma separated, or * for any).
|
|
# Native mobile apps are not subject to CORS. Editable at runtime from the panel
|
|
# (Web App section), which writes the change back into this file.
|
|
CORS_ALLOW_ORIGINS=http://localhost:5173
|
|
|
|
# Web App address, probed by GET /api/status and shown on the panel. Editable at
|
|
# runtime from the panel (Web App section).
|
|
WEBAPP_URL=http://localhost:5173
|
|
|
|
# PocketBase auth collection holding app users (default: users).
|
|
AUTH_USERS_COLLECTION=users
|
|
|
|
# Local JSON store for plugin enable-state + config (default: plugins.json).
|
|
PLUGINS_FILE=plugins.json
|
|
|
|
# --- Legacy names -----------------------------------------------------------
|
|
# PB_URL, PB_ADMIN_EMAIL, PB_ADMIN_PASSWORD, PORT and CORS_ORIGINS are still
|
|
# honoured for older deployments; the POCKETBASE_*/API_ADDR names above win when
|
|
# both are set. AUTH_SECRET is gone — the server no longer mints its own JWTs.
|