fix(backend): allow local frontend cors

Author: tranhoangpich

apps/backend/Cargo.toml

@@ -11,7 +11,7 @@ serde_json = "1.0"
 tempfile = "3.12"
 thiserror = "1.0"
 tokio = { version = "1.39", features = ["macros", "rt-multi-thread"] }
-tower-http = { version = "0.5", features = ["trace"] }
+tower-http = { version = "0.5", features = ["trace", "cors"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 uuid = { version = "1.8", features = ["v4"] }

apps/backend/src/infra/http/router.rs

@@ -2,12 +2,23 @@ use crate::app::ScanService;
 use crate::infra::http::handlers::{health, scan_bundle};
 use axum::routing::{get, post};
 use axum::Router;
+use axum::http::{HeaderValue, Method};
+use tower_http::cors::{Any, CorsLayer};
 use tower_http::trace::TraceLayer;
 
 pub fn build_router(scan_service: ScanService) -> Router {
+    let cors = CorsLayer::new()
+        .allow_origin([
+            HeaderValue::from_static("http://localhost:3000"),
+            HeaderValue::from_static("http://127.0.0.1:3000"),
+        ])
+        .allow_methods([Method::GET, Method::POST])
+        .allow_headers(Any);
+
     Router::new()
         .route("/healthz", get(health))
         .route("/api/v1/scan", post(scan_bundle))
         .with_state(scan_service)
+        .layer(cors)
         .layer(TraceLayer::new_for_http())
 }