Fix CORS: support localhost and Codesignal preview domains

Author: SurenNorekyanCodesignal

src/main.ts

@@ -12,10 +12,25 @@ import { LogsService } from './common/logging/logs.service';
 async function bootstrap() {
   const app = await NestFactory.create<NestExpressApplication>(AppModule);
   app.enableCors({
-    origin: [
-      'http://localhost:3000',
-      /\.preview\.codesignal\.dev$/, // allow any Codesignal preview frontend
-    ],
+    origin: (origin, callback) => {
+      // Allow same-origin requests (like curl or health checks where no origin header is present)
+      if (!origin) {
+        return callback(null, true);
+      }
+
+      // Explicitly allow localhost:3000 for local dev
+      if (origin === 'http://localhost:3000') {
+        return callback(null, true);
+      }
+
+      // Allow any Codesignal preview subdomain
+      if (/^https:\/\/[a-z0-9-]+\.preview\.codesignal\.dev$/.test(origin)) {
+        return callback(null, true);
+      }
+
+      // Otherwise block
+      return callback(new Error(`CORS blocked for origin: ${origin}`), false);
+    },
     credentials: true,
   });
 
@@ -43,7 +58,6 @@ async function bootstrap() {
   );
 
   const port = Number(process.env.PORT) || 3001;
-
   await app.listen(port);
   console.log(`Application is running on: http://localhost:${port}`);
 }