From c8dc5f5ee55227d294de254fa965b1d2a0c7490a Mon Sep 17 00:00:00 2001
From: root <root@localhost>
Date: Sun, 14 Sep 2025 16:35:52 +0500
Subject: [PATCH] .

---
 .../api_gateway/filter/CorsHeaderFilter.java   | 17 ++++++++++++++++-
 src/main/resources/application.yml             | 18 ++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java b/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java
index 6ace78e..20aaa8c 100644
--- a/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java
+++ b/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java
@@ -16,14 +16,22 @@ public class CorsHeaderFilter implements GlobalFilter, Ordered {
     @Override
     public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
         ServerHttpRequest request = exchange.getRequest();
+        String path = request.getPath().value();
+        String method = request.getMethod().name();
+
+        // Log for debugging
+        System.out.println("CORS Filter - Path: " + path + ", Method: " + method);
 
         // Handle preflight requests immediately
-        if (request.getMethod().name().equals("OPTIONS")) {
+        if (method.equals("OPTIONS")) {
+            System.out.println("Handling OPTIONS preflight request for: " + path);
             ServerHttpResponse response = exchange.getResponse();
             HttpHeaders headers = response.getHeaders();
 
             // Set CORS headers for preflight
             String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN);
+            System.out.println("Origin: " + origin);
+
             if (origin != null && isAllowedOrigin(origin)) {
                 headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
             } else {
@@ -35,6 +43,8 @@ public class CorsHeaderFilter implements GlobalFilter, Ordered {
             headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
             headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600");
 
+            System.out
+                    .println("CORS headers set for preflight: " + headers.get(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN));
             response.setStatusCode(org.springframework.http.HttpStatus.OK);
             return Mono.empty();
         }
@@ -46,9 +56,11 @@ public class CorsHeaderFilter implements GlobalFilter, Ordered {
 
             // Check if downstream service already set CORS headers
             boolean hasCorsOrigin = headers.containsKey(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN);
+            System.out.println("After downstream service - Path: " + path + ", Has CORS: " + hasCorsOrigin);
 
             // Only override CORS headers if downstream service didn't set them
             if (!hasCorsOrigin) {
+                System.out.println("Adding CORS headers for: " + path);
                 String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN);
                 if (origin != null && isAllowedOrigin(origin)) {
                     headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
@@ -60,6 +72,9 @@ public class CorsHeaderFilter implements GlobalFilter, Ordered {
                 headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*");
                 headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
                 headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600");
+                System.out.println("CORS headers added for: " + path);
+            } else {
+                System.out.println("Downstream service already has CORS headers for: " + path);
             }
         }));
     }
diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml
index 511be45..1ac3996 100644
--- a/src/main/resources/application.yml
+++ b/src/main/resources/application.yml
@@ -24,6 +24,24 @@ spring:
           order: 100 # <-- Низкий приоритет (сработает последним)
 
       # CORS обрабатывается через CorsHeaderFilter
+      globalcors:
+        cors-configurations:
+          '[/**]':
+            allowed-origins:
+              - 'https://konturai.kz'
+              - 'http://localhost:*'
+              - 'http://127.0.0.1:*'
+              - 'https://localhost:*'
+              - 'https://127.0.0.1:*'
+            allowed-methods:
+              - GET
+              - POST
+              - PUT
+              - DELETE
+              - OPTIONS
+            allowed-headers: '*'
+            allow-credentials: true
+            max-age: 3600
 
 # Логирование для отладки маршрутизации
 logging: