From a63fd34edbd582864f7e5fdb85438004796bad64 Mon Sep 17 00:00:00 2001
From: Daniel <daniel@danvics.com>
Date: Mon, 20 Apr 2026 22:30:52 +0200
Subject: [PATCH] fix: scope CORS middleware to /api so static assets aren't
 rejected
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ES module script tags (<script type="module">) always send an Origin
header on fetch, even for same-origin requests. The global cors()
middleware was rejecting /js/bedside/index.js with 500 in the e2e
harness because the container's internal origin
(http://pediatric-ai-scribe:3000) is not in APP_URL/CORS_ORIGINS.

Production was unaffected (real users hit APP_URL, which is allowed),
but the fix is architecturally correct either way: CORS belongs on
the API boundary, not on static file serving. All protected routes
are under /api/*.

Unblocks the bedside smoke suite — now 26/26 green.
---
 server.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 93dd02e..5ca72d4 100644
--- a/server.js
+++ b/server.js
@@ -64,7 +64,9 @@ if (IS_PROD && allowedOrigins.length === 0) {
   console.error('[FATAL] Production mode but no APP_URL or CORS_ORIGINS set. Refusing to run with open CORS.');
   process.exit(1);
 }
-app.use(cors({
+// Scoped to /api only — static assets (including type="module" scripts which
+// always send an Origin header) must not be subject to CORS checks.
+app.use('/api', cors({
   origin: function(origin, callback) {
     // Allow requests with no origin (mobile apps, curl, server-to-server)
     if (!origin) return callback(null, true);