leads4less/server/src/app.ts

import Fastify from 'fastify';
import cookie from '@fastify/cookie';
import cors from '@fastify/cors';
import { getEnv } from './config/env.js';
import { deepResearchRoutes } from './routes/deep-research.js';
import { authRoutes } from './routes/auth.js';
import { healthRoutes } from './routes/health.js';
import { searchJobRoutes } from './routes/search-jobs.js';

function parseAllowedOrigins(rawOrigins: string) {
  return rawOrigins
    .split(',')
    .map((origin) => origin.trim())
    .filter(Boolean);
}

function resolveCorsOrigin(origin: string | undefined, allowedOrigins: string[], isProduction: boolean) {
  if (!origin) {
    return true;
  }

  if (!isProduction) {
    return origin;
  }

  return allowedOrigins.includes(origin) ? origin : false;
}

export async function buildApp() {
  const env = getEnv();
  const allowedOrigins = parseAllowedOrigins(env.APP_ORIGIN);
  const app = Fastify({
    logger: true,
  });

  await app.register(cors, {
    origin(origin, callback) {
      callback(null, resolveCorsOrigin(origin, allowedOrigins, env.NODE_ENV === 'production'));
    },
    credentials: true,
    methods: ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
  });

  await app.register(cookie, {
    secret: env.COOKIE_SECRET,
    hook: 'onRequest',
  });

  await app.register(healthRoutes, { prefix: '/api' });
  await app.register(authRoutes, { prefix: '/api' });
  await app.register(searchJobRoutes, { prefix: '/api' });
  await app.register(deepResearchRoutes, { prefix: '/api' });

  return app;
}