Fix admin login and add subscription popup settings

backend/src/app.rs

@@ -1,5 +1,8 @@
 use async_trait::async_trait;
-use axum::{http::Method, Router as AxumRouter};
+use axum::{
+    http::{header, HeaderName, Method},
+    Router as AxumRouter,
+};
 use loco_rs::{
     app::{AppContext, Hooks, Initializer},
     bgworker::{BackgroundWorker, Queue},
@@ -15,8 +18,8 @@ use migration::Migrator;
 use sea_orm::{
     ActiveModelTrait, ColumnTrait, EntityTrait, IntoActiveModel, QueryFilter, QueryOrder, Set,
 };
-use std::path::Path;
-use tower_http::cors::{Any, CorsLayer};
+use std::{collections::BTreeSet, path::Path};
+use tower_http::cors::CorsLayer;
 
 #[allow(unused_imports)]
 use crate::{
@@ -29,6 +32,48 @@ use crate::{
 };
 
 pub struct App;
+
+fn normalized_origin(value: &str) -> Option<String> {
+    let trimmed = value.trim().trim_end_matches('/').to_string();
+    if trimmed.is_empty() {
+        None
+    } else {
+        Some(trimmed)
+    }
+}
+
+fn collect_cors_origins() -> Vec<String> {
+    let mut origins = BTreeSet::new();
+
+    for origin in [
+        "http://127.0.0.1:4321",
+        "http://127.0.0.1:4322",
+        "http://localhost:4321",
+        "http://localhost:4322",
+    ] {
+        origins.insert(origin.to_string());
+    }
+
+    for key in [
+        "APP_BASE_URL",
+        "ADMIN_API_BASE_URL",
+        "ADMIN_FRONTEND_BASE_URL",
+        "PUBLIC_API_BASE_URL",
+        "PUBLIC_FRONTEND_BASE_URL",
+        "TERMI_CORS_ALLOWED_ORIGINS",
+    ] {
+        if let Ok(value) = std::env::var(key) {
+            for origin in value.split([',', ';', ' ']) {
+                if let Some(origin) = normalized_origin(origin) {
+                    origins.insert(origin);
+                }
+            }
+        }
+    }
+
+    origins.into_iter().collect()
+}
+
 #[async_trait]
 impl Hooks for App {
     fn app_name() -> &'static str {
@@ -76,8 +121,22 @@ impl Hooks for App {
             .add_route(controllers::subscription::routes())
     }
     async fn after_routes(router: AxumRouter, _ctx: &AppContext) -> Result<AxumRouter> {
+        let allowed_origins = collect_cors_origins()
+            .into_iter()
+            .filter_map(|origin| origin.parse().ok())
+            .collect::<Vec<_>>();
+        let allowed_headers = [
+            header::ACCEPT,
+            header::ACCEPT_LANGUAGE,
+            header::AUTHORIZATION,
+            header::CONTENT_LANGUAGE,
+            header::CONTENT_TYPE,
+            header::COOKIE,
+            header::ORIGIN,
+            HeaderName::from_static("x-requested-with"),
+        ];
         let cors = CorsLayer::new()
-            .allow_origin(Any)
+            .allow_origin(allowed_origins)
             .allow_methods([
                 Method::GET,
                 Method::POST,
@@ -85,7 +144,8 @@ impl Hooks for App {
                 Method::PATCH,
                 Method::DELETE,
             ])
-            .allow_headers(Any);
+            .allow_headers(allowed_headers)
+            .allow_credentials(true);
 
         Ok(router.layer(cors))
     }