1780 bug correct cors configuration on admin route group

[OluwapelumiElisha]

Description

Corrects the CORS configuration applied to the admin route group, resolving issues where the admin dashboard was blocked by the global exact-match CORS configuration.

Previously, applySecurityMiddleware utilized a strict exact-match cors() implementation which only checked static ALLOWED_ORIGINS. Additionally, the global OPTIONS preflight handler intercepted all preflight requests, blocking administrative domains dynamically defined in CORS_ALLOWED_ORIGINS.

This PR corrects this behavior by explicitly applying the configurable createCorsMiddleware() (which reads cors.allowedOrigins and CORS_ALLOWED_ORIGINS) to all /api/admin prefixed routes. It also updates the global applySecurityMiddleware to correctly bypass its static CORS handlers (including OPTIONS preflight checks) for any request routed to the admin group.

Changes Made

• Modified applySecurityMiddleware in src/config/express.ts to skip its static cors(corsOptions) and app.options("*") processing for paths starting with /api/admin.
• Added app.use("/api/admin", createCorsMiddleware()); in src/index.ts to seamlessly apply the dynamically configurable CORS allowlist specifically for admin-related requests.

Related Issues

Fixes #1780

[drips-wave]

@OluwapelumiElisha Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits