fix: add CLIENT_URL and CHECKOUT_BASE_URL to CORS and trusted origins for self-hosted deployments

Author: ramadanomar

server/src/utils/auth.ts

@@ -68,18 +68,19 @@ export const auth = betterAuth({
 			"https://*.useautumn.com",
 		];
 
-		// Better Auth validates origins independently from app-level CORS.
-		// Allow local multi-port setups for any non-production runtime.
+		// Always trust CLIENT_URL and CHECKOUT_BASE_URL (required for self-hosted deployments)
+		if (process.env.CLIENT_URL) {
+			origins.push(process.env.CLIENT_URL);
+		}
+		if (process.env.CHECKOUT_BASE_URL) {
+			origins.push(process.env.CHECKOUT_BASE_URL);
+		}
+
+		// Allow local multi-port setups for any non-production runtime
 		if (process.env.NODE_ENV !== "production") {
-			// Add ports 3000-3010 for multiple instances
 			for (let i = 0; i <= 10; i++) {
 				origins.push(`http://localhost:${3000 + i}`);
 			}
-
-			// Support multi-worktree dev with offset ports (e.g. localhost:3100)
-			if (process.env.CLIENT_URL) {
-				origins.push(process.env.CLIENT_URL);
-			}
 		}
 
 		return origins;

server/src/utils/corsOrigins.ts

@@ -19,6 +19,18 @@ export const ALLOWED_ORIGINS = [
 /** Allow any localhost origin in dev for multi-worktree support */
 export const isAllowedOrigin = (origin: string): string | undefined => {
 	if (ALLOWED_ORIGINS.includes(origin)) return origin;
+
+	// Allow CLIENT_URL and CHECKOUT_BASE_URL for self-hosted deployments
+	if (process.env.CLIENT_URL && origin === process.env.CLIENT_URL) {
+		return origin;
+	}
+	if (
+		process.env.CHECKOUT_BASE_URL &&
+		origin === process.env.CHECKOUT_BASE_URL
+	) {
+		return origin;
+	}
+
 	if (
 		process.env.NODE_ENV !== "production" &&
 		/^https?:\/\/localhost:\d+$/.test(origin)

server/tests/unit/corsOrigins.test.ts

@@ -3,9 +3,13 @@ import { ALLOWED_ORIGINS, isAllowedOrigin } from "@/utils/corsOrigins.js";
 
 describe("isAllowedOrigin", () => {
 	const originalNodeEnv = process.env.NODE_ENV;
+	const originalClientUrl = process.env.CLIENT_URL;
+	const originalCheckoutBaseUrl = process.env.CHECKOUT_BASE_URL;
 
 	afterEach(() => {
 		process.env.NODE_ENV = originalNodeEnv;
+		process.env.CLIENT_URL = originalClientUrl;
+		process.env.CHECKOUT_BASE_URL = originalCheckoutBaseUrl;
 	});
 
 	describe("production", () => {
@@ -63,4 +67,55 @@ describe("isAllowedOrigin", () => {
 			expect(isAllowedOrigin("http://localhost:3000?x=1")).toBeUndefined();
 		});
 	});
+
+	describe("self-hosted env URLs", () => {
+		test("allows CLIENT_URL in production", () => {
+			process.env.NODE_ENV = "production";
+			process.env.CLIENT_URL =
+				"https://autumn-dashboard-production.up.railway.app";
+			expect(
+				isAllowedOrigin("https://autumn-dashboard-production.up.railway.app"),
+			).toBe("https://autumn-dashboard-production.up.railway.app");
+		});
+
+		test("allows CHECKOUT_BASE_URL in production", () => {
+			process.env.NODE_ENV = "production";
+			process.env.CHECKOUT_BASE_URL =
+				"https://autumn-checkout-production.up.railway.app";
+			expect(
+				isAllowedOrigin("https://autumn-checkout-production.up.railway.app"),
+			).toBe("https://autumn-checkout-production.up.railway.app");
+		});
+
+		test("allows both CLIENT_URL and CHECKOUT_BASE_URL simultaneously", () => {
+			process.env.NODE_ENV = "production";
+			process.env.CLIENT_URL = "https://dashboard.mycompany.com";
+			process.env.CHECKOUT_BASE_URL = "https://checkout.mycompany.com";
+			expect(isAllowedOrigin("https://dashboard.mycompany.com")).toBe(
+				"https://dashboard.mycompany.com",
+			);
+			expect(isAllowedOrigin("https://checkout.mycompany.com")).toBe(
+				"https://checkout.mycompany.com",
+			);
+		});
+
+		test("still rejects unrelated origins when env URLs are set", () => {
+			process.env.NODE_ENV = "production";
+			process.env.CLIENT_URL = "https://dashboard.mycompany.com";
+			process.env.CHECKOUT_BASE_URL = "https://checkout.mycompany.com";
+			expect(isAllowedOrigin("https://evil.com")).toBeUndefined();
+			expect(
+				isAllowedOrigin("https://not-autumn.up.railway.app"),
+			).toBeUndefined();
+		});
+
+		test("rejects custom domains when env URLs are unset", () => {
+			process.env.NODE_ENV = "production";
+			delete process.env.CLIENT_URL;
+			delete process.env.CHECKOUT_BASE_URL;
+			expect(
+				isAllowedOrigin("https://autumn-dashboard-production.up.railway.app"),
+			).toBeUndefined();
+		});
+	});
 });