fix(backend): CORS misconfiguration blocks all API calls in production (Hugging Face)

[archittmittal]

Summary

The CORSMiddleware in backend/main.py (lines 54–59) hardcodes allow_origins to only ["http://localhost:3000"]. In any production deployment — specifically the official Hugging Face Space — the frontend is served from a different origin. This makes the entire deployed application non-functional.

---

Affected Code

# backend/main.py:54-59  (current — broken in production)
app.add_middleware(
    CORSMiddleware,
    allow_origins=["http://localhost:3000"],   # ← hardcoded dev-only origin
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

---

Steps to Reproduce

1. Deploy the project to Hugging Face Spaces (or any production host where frontend ≠ localhost:3000).
2. Open the deployed Space URL in a browser and open DevTools → Network.
3. Enter a repo name and click Start Agents.
4. Observe the OPTIONS preflight request to /start fail with HTTP 403 and:

Access to fetch at 'https://…/start' from origin 'https://…hf.space'
has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header
has a value that is not equal to the supplied origin.

---

Impact

Feature	Status in Production
Start Agents	❌ Broken — CORS blocks POST /start
Stop Agents	❌ Broken — CORS blocks POST /stop
Web IDE file tree	❌ Broken — CORS blocks GET /repo/.../tree
Web IDE file open/save	❌ Broken — CORS blocks GET and POST /repo/.../file
WebSocket logs	✅ Works (WebSocket handshake is not blocked by CORS)

The entire Hugging Face Space is unusable except for the real-time log stream.

---

Proposed Fix

Read allowed origins from an environment variable so each deployment can configure its own frontend URL:

# backend/main.py  — proposed fix
import os

ALLOWED_ORIGINS = [
    "http://localhost:3000",
    "http://localhost:8000",
]

# Set FRONTEND_URL in HF Secrets for production deployments
frontend_url = os.getenv("FRONTEND_URL")
if frontend_url:
    ALLOWED_ORIGINS.append(frontend_url)

app.add_middleware(
    CORSMiddleware,
    allow_origins=ALLOWED_ORIGINS,
    allow_origin_regex=r"https://.*\.hf\.space",  # covers all HF spaces automatically
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

---

Files to Change

• backend/main.py lines 54–59: update CORSMiddleware configuration as shown above.

---

Acceptance Criteria

• Opening the Hugging Face Space and clicking Start Agents does not produce a CORS error in the browser console.
• GET /repo/.../tree and GET /repo/.../file work correctly in the Web IDE from the HF Space origin.
• Local development with localhost:3000 continues to work without any changes.
• No production URLs are hardcoded — they must be configurable via environment variables / secrets.