1
# backend/src/middleware/vercel_cors_middleware.py
2
"""
3
🚀 Vercel-Specific CORS Middleware for Preview Deployments
4
Handles dynamic Vercel preview URLs and ensures OPTIONS requests work
5
"""
6

7
import re
8
import logging
9
from fastapi import Request, Response
10
from fastapi.responses import JSONResponse
11
from starlette.middleware.base import BaseHTTPMiddleware
12
from typing import Callable
13
from ..config import get_settings
14

15
logger = logging.getLogger(__name__)
16
settings = get_settings()
17

18

19
class VercelCORSMiddleware(BaseHTTPMiddleware):
20
    """
21
    Enhanced CORS middleware specifically for Vercel deployments
22
    - Handles dynamic preview URLs
23
    - Ensures OPTIONS requests are processed correctly
24
    - Works with Vercel's serverless environment
25
    """
26

27
    def __init__(self, app):
28
        super().__init__(app)
29
        
30
        # Static allowed origins from config
31
        self.static_origins = settings.cors_origins_list
32
        
33
        # Regex patterns for dynamic Vercel URLs
34
        self.vercel_patterns = [
35
            # Pattern: https://project-name-git-branch-team.vercel.app
36
            re.compile(r'https://[\w-]+-git-[\w-]+-[\w-]+\.vercel\.app'),
37
            # Pattern: https://project-name-hash.vercel.app  
38
            re.compile(r'https://[\w-]+-[a-z0-9]{9}\.vercel\.app'),
39
            # Your specific preview domain
40
            re.compile(r'https://preview\.domain\.de'),
41
        ]
42
        
43
        # CORS headers matching your main CORS config
44
        self.cors_headers = {
45
            "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
46
            "Access-Control-Allow-Headers": "Content-Type, Authorization, apikey, x-client-info, x-supabase-api-version, x-forwarded-for, x-real-ip",
47
            "Access-Control-Allow-Credentials": "true",
48
            "Access-Control-Max-Age": "3600",
49
        }
50

51
    async def dispatch(self, request: Request, call_next: Callable) -> Response:
52
        """Handle CORS for all requests, especially OPTIONS preflight"""
53
        
54
        origin = request.headers.get("origin")
55
        is_allowed = self._is_origin_allowed(origin)
56
        
57
        # Log for debugging Vercel deployments
58
        logger.info(f"🔍 CORS Check: {request.method} {request.url.path} from {origin}")
59
        logger.info(f"📍 Origin allowed: {is_allowed}")
60
        
61
        # Handle OPTIONS preflight requests immediately
62
        if request.method == "OPTIONS":
63
            logger.info("⚡ Handling OPTIONS preflight in CORS middleware")
64
            
65
            headers = {}
66
            
67
            # Add all CORS headers
68
            headers.update(self.cors_headers)
69
            
70
            # Add origin if allowed
71
            if is_allowed and origin:
72
                headers["Access-Control-Allow-Origin"] = origin
73
                logger.info(f"✅ Added CORS origin: {origin}")
74
            else:
75
                logger.warning(f"❌ Origin not allowed: {origin}")
76
                # Still return 200 for OPTIONS, but without origin header
77
                
78
            return JSONResponse(
79
                content=None,
80
                status_code=200,
81
                headers=headers
82
            )
83
        
84
        # Process actual request
85
        response = await call_next(request)
86
        
87
        # Add CORS headers to response
88
        if is_allowed and origin:
89
            response.headers["Access-Control-Allow-Origin"] = origin
90
            response.headers["Access-Control-Allow-Credentials"] = "true"
91
            
92
        return response
93
    
94
    def _is_origin_allowed(self, origin: str) -> bool:
95
        """Check if origin is allowed (static list + dynamic patterns)"""
96
        
97
        if not origin:
98
            return False
99
            
100
        # Check static allowed origins
101
        if origin in self.static_origins:
102
            logger.debug(f"✅ Static origin match: {origin}")
103
            return True
104
            
105
        # Check dynamic Vercel patterns
106
        for pattern in self.vercel_patterns:
107
            if pattern.match(origin):
108
                logger.debug(f"✅ Pattern match: {origin}")
109
                return True
110
                
111
        logger.debug(f"❌ No match for origin: {origin}")
112
        return False