From cab79d6dd6ce71f156a60966d9127c0929cf7474 Mon Sep 17 00:00:00 2001
From: Jimil <jimildigaswala@gmail.com>
Date: Sun, 13 Sep 2026 00:42:52 +0530
Subject: [PATCH] fix: append .onrender.com for bare Render hostnames and clean
 CORS patterns

---
 frontend/src/api.ts                     | 6 ++++--
 render.yaml                             | 2 +-
 src/main/resources/application-prod.yml | 2 +-
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/frontend/src/api.ts b/frontend/src/api.ts
index 1fe20b3..2b7a300 100644
--- a/frontend/src/api.ts
+++ b/frontend/src/api.ts
@@ -19,8 +19,10 @@ const TOKEN_KEY = 'settleup.token'
  * expose service hostnames without a scheme and do not support string interpolation), and we
  * prepend https:// ourselves.
  */
-const API_HOST = import.meta.env.VITE_API_HOST as string | undefined
-const API_ROOT = API_HOST ? `https://${API_HOST.replace(/^https?:\/\//, '')}` : ''
+const rawHost = (import.meta.env.VITE_API_HOST as string | undefined)?.trim().replace(/^https?:\/\//, '')
+const isLocal = rawHost?.startsWith('localhost') || rawHost?.startsWith('127.0.0.1')
+const API_HOST = rawHost && !rawHost.includes('.') && !isLocal ? `${rawHost}.onrender.com` : rawHost
+const API_ROOT = API_HOST ? (isLocal ? `http://${API_HOST}` : `https://${API_HOST}`) : ''
 
 /** Absolute URL for an API path, used for links the browser follows directly (e.g. CSV export). */
 export function apiUrl(path: string): string {
diff --git a/render.yaml b/render.yaml
index 3abfc4c..ff49ca6 100644
--- a/render.yaml
+++ b/render.yaml
@@ -71,7 +71,7 @@ services:
       # reference each other and the Blueprint would fail to resolve the cycle. The wildcard gets
       # the first deploy working; tighten it to the exact origin afterwards (see README).
       - key: CORS_ALLOWED_ORIGINS
-        value: https://settleup-web.onrender.com/**
+        value: https://*.onrender.com,https://settleup-web.onrender.com
 
   # ---------------------------------------------------------------- Cache
   - type: keyvalue
diff --git a/src/main/resources/application-prod.yml b/src/main/resources/application-prod.yml
index 7ee116d..4f25397 100644
--- a/src/main/resources/application-prod.yml
+++ b/src/main/resources/application-prod.yml
@@ -54,7 +54,7 @@ settleup:
   cors:
     # Set to the exact frontend origin once it is known. The default permits any Render subdomain
     # so the first deploy works before the static site URL has been assigned.
-    allowed-origins: ${CORS_ALLOWED_ORIGINS:https://settleup-web.onrender.com/**}
+    allowed-origins: ${CORS_ALLOWED_ORIGINS:https://*.onrender.com,https://settleup-web.onrender.com}
 
 logging:
   level: