rebase

app/config.py

@@ -13,9 +13,10 @@ from __future__ import annotations
 
 from functools import lru_cache
 from pathlib import Path
+from typing import Annotated
 
 from pydantic import Field, field_validator
-from pydantic_settings import BaseSettings, SettingsConfigDict
+from pydantic_settings import BaseSettings, NoDecode, SettingsConfigDict
 
 
 class Settings(BaseSettings):
@@ -37,7 +38,10 @@ class Settings(BaseSettings):
     jwt_algorithm: str = "HS256"
     access_token_expire_minutes: int = 60 * 24  # 24 hours
     refresh_token_expire_minutes: int = 60 * 24 * 7  # 7 days
-    cors_origins: list[str] = Field(default_factory=lambda: ["*"])
+    # `NoDecode` tells pydantic-settings to NOT JSON-parse the env var value
+    # before passing it to our `_split_cors` validator. Without it, the value
+    # `CORS_ORIGINS=http://a,http://b` would be rejected as invalid JSON.
+    cors_origins: Annotated[list[str], NoDecode] = Field(default_factory=lambda: ["*"])
 
     # === Admin setup ===
     admin_setup_token: str = ""  # if empty, will be auto-generated and stored in DB