fix(api): add CORS headers to allow cross-origin requests from Tauri desktop app

cmd/server/main.go

@@ -37,6 +37,7 @@ import (
 	"git.dustin.coffee/hobokenchicken/dumpsterChat/internal/webhook"
 	"github.com/go-chi/chi/v5"
 	chimw "github.com/go-chi/chi/v5/middleware"
+	"github.com/go-chi/cors"
 	httpSwagger "github.com/swaggo/http-swagger"
 )
 
@@ -70,7 +71,7 @@ func main() {
 	sessionStore := auth.NewSessionStore(database.DB, cfg)
 
 	// WebSocket origin allowlist
-	wsOrigins := []string{"https://" + cfg.Host}
+	wsOrigins := []string{"https://" + cfg.Host, "http://tauri.localhost", "https://tauri.localhost", "tauri://localhost"}
 	if cfg.Host == "localhost" {
 		wsOrigins = append(wsOrigins, "http://localhost:"+cfg.Port)
 	}
@@ -119,6 +120,16 @@ func main() {
 	memberHandler := server.NewMemberHandler(database.DB)
 
 	r := chi.NewRouter()
+
+	r.Use(cors.Handler(cors.Options{
+		AllowedOrigins:   []string{"https://" + cfg.Host, "http://localhost:" + cfg.Port, "http://tauri.localhost", "https://tauri.localhost", "tauri://localhost"},
+		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"},
+		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
+		ExposedHeaders:   []string{"Link"},
+		AllowCredentials: true,
+		MaxAge:           300,
+	}))
+
 	r.Use(chimw.Logger)
 	r.Use(chimw.Recoverer)
 	r.Use(chimw.RequestID)