fix: add UAT/dev domains to cors_origins

Add dev.cartsnitch.com and uat.cartsnitch.com to the CORS origins list to match the infra HTTPRoute domains and fix auth blocking on UAT. Refs: CAR-992 Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-05-23 20:45:56 +00:00
1 changed files with 6 additions and 1 deletions
@@ -23,7 +23,12 @@ class Settings(BaseSettings):

    auth_service_url: str = "http://auth:3001"

-    cors_origins: list[str] = ["http://localhost:3000", "https://cartsnitch.com"]
+    cors_origins: list[str] = [
+        "http://localhost:3000",
+        "https://cartsnitch.com",
+        "https://dev.cartsnitch.com",
+        "https://uat.cartsnitch.com",
+    ]

    receiptwitness_url: str = "http://receiptwitness:8001"
    stickershock_url: str = "http://stickershock:8002"