Fix/p1 cors backend allowed origins MERGE AFTER PR #109 (#110)

* fix(fullstack): consent gating, Beanie 2 Mongo init, Framingham module, auth routes

- Backend: user consent fields; POST/GET /api/v1/consent; health consent guard
  on risk assessment; init_beanie via PyMongo connection_string (Beanie 2);
  drop Motor dependency; CORS origins include Vite fallback port 5174
- Frontend: ConsentPage, consent service, RequireAuth + RequireHealthConsent,
  auth context consent sync, guarded dashboard/questionnaire/modules,
  Login/Signup post-auth routing, Framingham UI without demo fallback
- i18n: framingham namespace and nav strings across locales
- Tests: test-utils consent defaults; Dashboard tests aligned

Made-with: Cursor

* fix(frontend): Framingham risk must use backend API with validated responses

Route assessment through healthRiskService (POST /health/risk-assessment only).
Parse and validate HealthRiskOutput before rendering; invalid payloads show a
clear error plus toast. Surface server/network failures via toasts without
fabricating results. Add unit and integration tests; extend i18n for invalid
response copy.

Made-with: Cursor

* fix(backend): align CORS allowed origins with Vite and local dev

Default ALLOWED_ORIGINS to include localhost/127.0.0.1 on ports 5173, 5174
(Vite) and 3000 (common Docker UI mapping). Update backend/.env.example and
README so local .env stays consistent and browsers stop blocking cross-origin
API calls from the standard frontend URLs.

Made-with: Cursor

---------

Co-authored-by: smagen10 <maayizsameer@gmail.com>

Author: ZukaiSagan

README.md

@@ -177,7 +177,7 @@ npm run dev
 | `JWT_REFRESH_SECRET` | Refresh token secret | `dev-refresh-secret-...` |
 | `ACCESS_TOKEN_EXPIRE_MINUTES` | Access token TTL | `15` |
 | `REFRESH_TOKEN_EXPIRE_DAYS` | Refresh token TTL | `7` |
-| `ALLOWED_ORIGINS` | CORS allowed origins | `http://localhost:5173` |
+| `ALLOWED_ORIGINS` | CORS allowed origins (comma-separated); see `backend/.env.example` | Vite `:5173`/`:5174`, `127.0.0.1`, Docker UI `:3000` |
 
 #### Frontend (`frontend/.env`)
 

backend/.env.example

@@ -24,7 +24,9 @@ REFRESH_TOKEN_EXPIRE_DAYS=7
 # ─────────────────────────────────────────────────────────────────────────────
 # CORS Configuration
 # ─────────────────────────────────────────────────────────────────────────────
-# Comma-separated origins allowed to call the API (e.g., frontend dev server)
-# Include 5174 if Vite picks a fallback port when 5173 is busy
-ALLOWED_ORIGINS=http://localhost:5173,http://127.0.0.1:5173,http://localhost:5174,http://127.0.0.1:5174
+# Comma-separated origins allowed to call the API. Include both hostname styles:
+#   - Vite dev server: :5173 (and :5174 if 5173 is busy)
+#   - Docker/nginx static UI often mapped to :3000
+# If unset, the API uses the same defaults as in backend/src/main.py (Settings.ALLOWED_ORIGINS).
+ALLOWED_ORIGINS=http://localhost:5173,http://127.0.0.1:5173,http://localhost:5174,http://127.0.0.1:5174,http://localhost:3000,http://127.0.0.1:3000
 ALLOWED_ORIGIN_REGEX=

backend/src/main.py

@@ -10,6 +10,7 @@
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 from jose import jwt, JWTError
+from pydantic import Field
 from pydantic_settings import BaseSettings
 from dotenv import load_dotenv
 from slowapi import Limiter, _rate_limit_exceeded_handler
@@ -23,15 +24,28 @@
 
 # --- 1. CONFIGURATION ---
 load_dotenv(os.path.join(os.path.dirname(__file__), '..', '.env'))
+_DEFAULT_ALLOWED_ORIGINS = (
+    "http://localhost:5173,"
+    "http://127.0.0.1:5173,"
+    "http://localhost:5174,"
+    "http://127.0.0.1:5174,"
+    "http://localhost:3000,"
+    "http://127.0.0.1:3000"
+)
+
+
 class Settings(BaseSettings):
     MONGO_URL: str
     MONGO_DB_NAME: str
     JWT_ACCESS_SECRET: str
     JWT_REFRESH_SECRET: str
     ACCESS_TOKEN_EXPIRE_MINUTES: int
     REFRESH_TOKEN_EXPIRE_DAYS: int
-    ALLOWED_ORIGINS: str
-    ALLOWED_ORIGIN_REGEX: str | None = None
+    ALLOWED_ORIGINS: str = Field(
+        default=_DEFAULT_ALLOWED_ORIGINS,
+        description="Comma-separated browser origins permitted for CORS (Vite :5173/5174, Dockerized UI :3000).",
+    )
+    ALLOWED_ORIGIN_REGEX: str | None = Field(default=None)
 
 settings = Settings()
 
@@ -162,7 +176,9 @@ async def lifespan(app: FastAPI):
 app = FastAPI(title="Simple Health App API (MongoDB)", lifespan=lifespan)
 app.state.limiter = limiter
 app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
-allowed_origins = [origin.strip() for origin in settings.ALLOWED_ORIGINS.split(',') if origin.strip()]
+allowed_origins = [
+    origin.strip() for origin in settings.ALLOWED_ORIGINS.split(",") if origin.strip()
+]
 
 app.add_middleware(
     CORSMiddleware,