API URL was not taken from environment after docker container and npm was build

CORS prevented from loading

backend/config/config.go

@@ -26,6 +26,9 @@ type Config struct {
 
 	DevTesting string // "yes" or "no", used to determine if we are in a test environment
 
+	// Frontend URLs for CORS
+	FrontendURL string // Frontend URL for CORS configuration
+
 	// PDF Templates
 	TemplatesDir  string // Directory where PDF templates are stored
 	ExportTempDir string // Directory for temporary PDF exports
@@ -50,6 +53,7 @@ func defaultConfig() *Config {
 		LogLevel:      "INFO",
 		Environment:   "production",
 		DevTesting:    "no",          // Default to "no", can be overridden in tests
+		FrontendURL:   "http://localhost:5173", // Default frontend URL for development
 		TemplatesDir:  "./templates", // Default templates directory
 		ExportTempDir: "./xporttemp", // Default export temp directory
 	}
@@ -117,6 +121,10 @@ func LoadConfig() *Config {
 		fmt.Printf("DEBUG LoadConfig - DEVTESTING nicht gefunden, setze DevTesting auf 'no'\n")
 	}
 
+	// Frontend URL
+	if frontendURL := os.Getenv("BASE_URL"); frontendURL != "" {
+		config.FrontendURL = frontendURL
+
 	// Templates Directory
 	if templatesDir := os.Getenv("TEMPLATES_DIR"); templatesDir != "" {
 		config.TemplatesDir = templatesDir

backend/router/setup.go

@@ -1,18 +1,28 @@
 package router
 
 import (
+	"bamort/config"
+
 	"github.com/gin-contrib/cors"
 	"github.com/gin-gonic/gin"
 )
 
 func SetupGin(r *gin.Engine) {
+	// Build allowed origins list from configuration
+	allowedOrigins := []string{
+		config.Cfg.FrontendURL,
+		"http://localhost:5173",    // Development frontend
+		"https://bamort.trokan.de", // Production frontend
+	}
+
 	// Add CORS middleware
 	r.Use(cors.New(cors.Config{
 		//AllowOrigins:     []string{"http://localhost:3000"}, // Replace with your frontend's URL
-		AllowOrigins:     []string{"*"},
+		AllowOrigins:     allowedOrigins,
 		AllowMethods:     []string{"GET", "POST", "PUT", "DELETE"},
 		AllowHeaders:     []string{"Origin", "Content-Type", "Authorization"},
 		ExposeHeaders:    []string{"Content-Length"},
 		AllowCredentials: true,
+		MaxAge:           12 * 3600, // Cache preflight for 12 hours
 	}))
 }