OPCODE-Open-Spring-Fest · crocodilelurker · Oct 12, 2025 · Copilot · Oct 12, 2025
diff --git a/.gitignore b/.gitignore
@@ -1 +1 @@
-node_modules
+node_modules
diff --git a/backend/.env b/backend/.env
@@ -0,0 +1 @@
+PORT = 3000
diff --git a/backend/README.md b/backend/README.md
@@ -0,0 +1 @@
+Backend Folder
diff --git a/backend/config/README.md b/backend/config/README.md
@@ -0,0 +1 @@
+for config files like cloudinary etc
diff --git a/backend/controllers/README.md b/backend/controllers/README.md
@@ -0,0 +1 @@
+Controller Business Logic for each route
diff --git a/backend/index.js b/backend/index.js
@@ -0,0 +1,21 @@
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const cors = require('cors');
+const bodyParser = require('body-parser');
+
+require('dotenv').config();//only uploading the public env file 
+
+const app = express();
+app.use(cookieParser());
+app.use(bodyParser.json());
+app.use(bodyParser.urlencoded({extended:true}));
+app.use(cors({
+    origin : '*'
+}))
-app.use(cors({
-    origin : '*'
-}))
+// Restrict CORS origins to trusted domains from environment variable
+const allowedOrigins = process.env.CORS_ORIGIN
+    ? process.env.CORS_ORIGIN.split(',').map(origin => origin.trim())
+    : ['http://localhost:3000']; // fallback for development
+app.use(cors({
+    origin: function (origin, callback) {
+        // allow requests with no origin (like mobile apps, curl, etc.)
+        if (!origin) return callback(null, true);
+        if (allowedOrigins.indexOf(origin) !== -1) {
+            return callback(null, true);
+        } else {
+            return callback(new Error('Not allowed by CORS'));
+        }
+    }
+}));
-app.use(cors({
-    origin : '*'
-}))
+// Restrict CORS origins to trusted domains from environment variable
+const allowedOrigins = process.env.CORS_ORIGIN
+    ? process.env.CORS_ORIGIN.split(',').map(origin => origin.trim())
+    : ['http://localhost:3000']; // fallback for development
+app.use(cors({
+    origin: function (origin, callback) {
+        // allow requests with no origin (like mobile apps, curl, etc.)
+        if (!origin) return callback(null, true);
+        if (allowedOrigins.indexOf(origin) !== -1) {
+            return callback(null, true);
+        } else {
+            return callback(new Error('Not allowed by CORS'));
+        }
+    }
+}));
+app.get('/health',(req,res)=>{
+    res.send('OK');
+})
+const PORT = process.env.PORT || 3001;
+app.listen(PORT,() => {
+    console.log(`Server is running on port ${PORT}`);
+})
diff --git a/backend/models/README.md b/backend/models/README.md
@@ -0,0 +1 @@
+Mongo Models for data