rebase

app/config.py

@@ -13,10 +13,9 @@ from __future__ import annotations
 
 from functools import lru_cache
 from pathlib import Path
-from typing import Annotated
 
-from pydantic import Field, field_validator
-from pydantic_settings import BaseSettings, NoDecode, SettingsConfigDict
+from pydantic import Field
+from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
 class Settings(BaseSettings):
@@ -38,10 +37,11 @@ class Settings(BaseSettings):
     jwt_algorithm: str = "HS256"
     access_token_expire_minutes: int = 60 * 24  # 24 hours
     refresh_token_expire_minutes: int = 60 * 24 * 7  # 7 days
-    # `NoDecode` tells pydantic-settings to NOT JSON-parse the env var value
-    # before passing it to our `_split_cors` validator. Without it, the value
-    # `CORS_ORIGINS=http://a,http://b` would be rejected as invalid JSON.
-    cors_origins: Annotated[list[str], NoDecode] = Field(default_factory=lambda: ["*"])
+    # Comma-separated list of allowed CORS origins, e.g.
+    #   CORS_ORIGINS=http://localhost:8080,http://localhost:5173
+    # Special value "*" allows all origins.
+    # Use `settings.cors_origins_list` to access the parsed list.
+    cors_origins: str = "*"
 
     # === Admin setup ===
     admin_setup_token: str = ""  # if empty, will be auto-generated and stored in DB
@@ -109,12 +109,16 @@ class Settings(BaseSettings):
         if not self.assets_dir:
             self.assets_dir = str(Path(self.data_dir) / "assets")
 
-    @field_validator("cors_origins", mode="before")
-    @classmethod
-    def _split_cors(cls, v):
-        if isinstance(v, str):
-            return [item.strip() for item in v.split(",") if item.strip()]
-        return v
+    @property
+    def cors_origins_list(self) -> list[str]:
+        """Parse `cors_origins` (comma-separated string) into a list.
+
+        Whitespace is stripped from each entry, empty entries are dropped.
+        Returns `["*"]` if the field is empty or just whitespace.
+        """
+        if not self.cors_origins or not self.cors_origins.strip():
+            return ["*"]
+        return [o.strip() for o in self.cors_origins.split(",") if o.strip()]
 
 
 @lru_cache(maxsize=1)

app/main.py

@@ -98,7 +98,7 @@ def create_app() -> FastAPI:
     # CORS
     app.add_middleware(
         CORSMiddleware,
-        allow_origins=cfg.cors_origins,
+        allow_origins=cfg.cors_origins_list,
         allow_credentials=True,
         allow_methods=["*"],
         allow_headers=["*"],