chore: new release changes

- lock cors to defined values only

Author: anonhacker47

Readme.md

@@ -41,7 +41,17 @@ Feel free to reach out if you have anything else you'd like to see!
 
 Vertigo has now entered its **Alpha release** stage! You can try it out by downloading the latest ZIP from the [releases section](https://github.com/anonhacker47/vertigo/releases).
 
-After extracting the ZIP, run the app using the appropriate script for your operating system:
+After extracting the ZIP, follow these steps:
+
+1. **Create a `.env` file** in the root directory of the app and set your secret key:
+
+```env
+SECRET_KEY=your-very-secret-key
+```
+
+This key is used for authentication tokens and other security-related features. You can also configure other settings by refering config.py or .flaskenv.
+
+2. Run the app using the appropriate script for your operating system:
 
 - **Linux**:  
   Run `launch.sh`

vertigo-backend/.flaskenv

@@ -2,5 +2,4 @@ FLASK_APP=run.py
 FLASK_DEBUG=1
 REFRESH_TOKEN_IN_BODY=false
 REFRESH_TOKEN_IN_COOKIE=true
-ACCESS_TOKEN_MINUTES=60
-PACKAGE_VERSION=0.0.2
+ACCESS_TOKEN_MINUTES=60

vertigo-backend/api/app.py

@@ -20,7 +20,7 @@ def create_app(config_class=Config):
             static_folder = "./wwwroot/static",
             template_folder = "./wwwroot")
     app.config.from_object(config_class)
-    
+   
     app.config['user_path'] = os.path.abspath("./Config/User/")
     app.config['sql_path'] = os.path.abspath("./Config/")
 
@@ -40,7 +40,9 @@ def create_app(config_class=Config):
     db.init_app(app)
     ma.init_app(app)
     if app.config['USE_CORS']:  # pragma: no branch
-        cors.init_app(app)
+        cors.init_app(app,resources={r"/api/*": {"origins": app.config['CORS_ORIGINS']}},
+        supports_credentials=app.config.get('CORS_SUPPORTS_CREDENTIALS', False)
+    )
     mail.init_app(app)
     apifairy.init_app(app)
 

vertigo-backend/config.py

@@ -31,6 +31,11 @@ class Config:
     USE_CORS = as_bool(os.environ.get('USE_CORS') or 'yes')
     CORS_SUPPORTS_CREDENTIALS = True
 
+    raw_origins = os.environ.get('CORS_ORIGINS', '')
+    CORS_ORIGINS = [origin.strip() for origin in raw_origins.split(',') if origin.strip()]  
+
+    PACKAGE_VERSION = os.environ.get('PACKAGE_VERSION', '0.0.1')
+
     # API documentation
     APIFAIRY_TITLE = 'Vertigo API'
     APIFAIRY_VERSION = '0.0.2'

vertigo-ui/.env.production

@@ -1,2 +1,2 @@
 VITE_Base_URL=""
-PACKAGE_VERSION=0.0.2
+PACKAGE_VERSION=0.0.3