From 3a7abdbc7ef600f8237a3553845e1040ae4f83db Mon Sep 17 00:00:00 2001
From: root <root@localhost>
Date: Sun, 14 Sep 2025 16:44:01 +0500
Subject: [PATCH] add cors

---
 .../kz/konturai/configuration/CorsConfig.java | 44 +++++++++++++++++++
 .../security/SecurityConfig.java              |  7 ++-
 2 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 src/main/java/kz/konturai/configuration/CorsConfig.java

diff --git a/src/main/java/kz/konturai/configuration/CorsConfig.java b/src/main/java/kz/konturai/configuration/CorsConfig.java
new file mode 100644
index 0000000..9e564fc
--- /dev/null
+++ b/src/main/java/kz/konturai/configuration/CorsConfig.java
@@ -0,0 +1,44 @@
+package kz.konturai.configuration;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+
+import java.util.Arrays;
+
+@Configuration
+public class CorsConfig {
+
+    @Bean
+    public CorsConfigurationSource corsConfigurationSource() {
+        CorsConfiguration configuration = new CorsConfiguration();
+
+        // Allow requests from your frontend
+        configuration.setAllowedOriginPatterns(Arrays.asList(
+                "http://localhost:*",
+                "https://localhost:*",
+                "http://127.0.0.1:*",
+                "https://127.0.0.1:*", "https://konturai.kz:*"));
+
+        // Allow all HTTP methods
+        configuration.setAllowedMethods(Arrays.asList(
+                "GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"));
+
+        // Allow all headers
+        configuration.setAllowedHeaders(Arrays.asList("*"));
+
+        // Allow credentials (cookies, authorization headers)
+        configuration.setAllowCredentials(true);
+
+        // Cache preflight response for 1 hour
+        configuration.setMaxAge(3600L);
+
+        // Apply this configuration to all paths
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/**", configuration);
+
+        return source;
+    }
+}
diff --git a/src/main/java/kz/konturai/configuration/security/SecurityConfig.java b/src/main/java/kz/konturai/configuration/security/SecurityConfig.java
index 340446e..f206844 100644
--- a/src/main/java/kz/konturai/configuration/security/SecurityConfig.java
+++ b/src/main/java/kz/konturai/configuration/security/SecurityConfig.java
@@ -13,15 +13,19 @@ import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.security.web.access.AccessDeniedHandler;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.web.cors.CorsConfigurationSource;
 
 @Configuration
 @EnableMethodSecurity
 public class SecurityConfig {
 
     private final JwtAuthenticationFilter jwtAuthenticationFilter;
+    private final CorsConfigurationSource corsConfigurationSource;
 
-    public SecurityConfig(JwtAuthenticationFilter jwtAuthenticationFilter) {
+    public SecurityConfig(JwtAuthenticationFilter jwtAuthenticationFilter,
+            CorsConfigurationSource corsConfigurationSource) {
         this.jwtAuthenticationFilter = jwtAuthenticationFilter;
+        this.corsConfigurationSource = corsConfigurationSource;
     }
 
     @Bean
@@ -37,6 +41,7 @@ public class SecurityConfig {
             response.getWriter().write("{\"message\":\"Forbidden\"}");
         };
         http
+                .cors(cors -> cors.configurationSource(corsConfigurationSource))
                 .csrf(csrf -> csrf.disable())
                 .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                 .authorizeHttpRequests(auth -> auth