From 7545a5ccdc05d193c96010d639f66295ab63471f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?API=E6=96=87=E6=A1=A3=E7=BB=B4=E6=8A=A4Agent?=
 <api-doc-agent@xiaoxiajianji.com>
Date: Sun, 28 Jun 2026 21:56:21 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E7=A1=AE=E4=BF=9D=E7=94=9F=E4=BA=A7CORS?=
 =?UTF-8?q?=E5=A7=8B=E7=BB=88=E5=8C=85=E5=90=ABsaas.xiaoxiajianji.com?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

之前的修复只在CORS_ORIGINS为空时才添加默认域名，
但生产环境通过环境变量设置了CORS_ORIGINS_RAW，
导致saas子域仍然不在允许列表中。

现在无论CORS_ORIGINS_RAW如何配置，都会确保包含
xiaoxiajianji.com和saas.xiaoxiajianji.com。
---
 apps/api/main.py | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/apps/api/main.py b/apps/api/main.py
index 64a2bcf7c..070049983 100644
--- a/apps/api/main.py
+++ b/apps/api/main.py
@@ -38,10 +38,11 @@ if settings.DEBUG:
     allow_origins = settings.CORS_ORIGINS  # Allow localhost in debug mode
 else:
     # In production, filter out any wildcard "*" origins
-    allow_origins = [origin for origin in settings.CORS_ORIGINS if origin != "*"]
-    if not allow_origins:
-        # Default to production domains if no valid origins configured
-        allow_origins = ["https://xiaoxiajianji.com", "https://saas.xiaoxiajianji.com"]
+    allow_origins = list({origin for origin in settings.CORS_ORIGINS if origin != "*"})
+    # Always ensure production domains are included
+    for domain in ("https://xiaoxiajianji.com", "https://saas.xiaoxiajianji.com"):
+        if domain not in allow_origins:
+            allow_origins.append(domain)
 
 app.add_middleware(
     CORSMiddleware,