file upload settings

apps/edr-freight-api/src/main.ts

@@ -12,7 +12,30 @@ import {
 import { AppModule } from "./app.module";
 
 async function bootstrap() {
-  const app = await NestFactory.create(AppModule, { cors: true });
+  const app = await NestFactory.create(AppModule);
+
+  // Dev CORS: reflect any localhost origin and allow credentials so the
+  // freight portal (5173), passenger portal (5174), backoffices (5183/5184)
+  // and any other dev port can call the API with cookies + Authorization.
+  // For production, restrict `origin` to known FQDNs.
+  app.enableCors({
+    origin: true, // reflect request origin
+    credentials: true,
+    methods: ["GET", "HEAD", "PUT", "PATCH", "POST", "DELETE", "OPTIONS"],
+    allowedHeaders: [
+      "Content-Type",
+      "Accept",
+      "Authorization",
+      "X-Requested-With",
+      // IAM context headers required by @tria-plc/api-common's JwtGuard
+      "organization-unit-id",
+      "delegator-position-id",
+      "current-project-id",
+      "current-position-id",
+    ],
+    exposedHeaders: ["Content-Disposition"],
+    maxAge: 86400, // cache preflight for 24h to cut chatter in dev
+  });
 
   app.setGlobalPrefix("api");
   app.useGlobalPipes(createValidationPipe());