From 8e16b612b430e20a49adbe8aa4c64a57d40befe4 Mon Sep 17 00:00:00 2001
From: Benevanio Santos <benevaniosantos930@gmail.com>
Date: Wed, 10 Jun 2026 15:35:32 -0300
Subject: [PATCH 1/2] fix: add Vercel preview regex and git-master origin to
 CORS allowlist

---
 frontend/vercel.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/vercel.json b/frontend/vercel.json
index 831e9b7..e06a47c 100644
--- a/frontend/vercel.json
+++ b/frontend/vercel.json
@@ -2,7 +2,7 @@
   "rewrites": [
     {
       "source": "/api/(.*)",
-      "destination": "http://jobsglobalscraper.ddns.net/api/$1"
+      "destination": "https://jobsglobalscraper.ddns.net/api/$1"
     },
     {
       "source": "/(.*)",

From a9386eb4beeeddebfdbf501a2cb07cb1bac6fba6 Mon Sep 17 00:00:00 2001
From: Benevanio Santos <benevaniosantos930@gmail.com>
Date: Wed, 10 Jun 2026 15:37:06 -0300
Subject: [PATCH 2/2] =?UTF-8?q?feat:=20corre=C3=A7=C3=A3o=20do=20cors?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/src/middleware/cors.ts | 21 ++++++++++++++-------
 vercel.json                    |  2 +-
 2 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/backend/src/middleware/cors.ts b/backend/src/middleware/cors.ts
index a0aa227..d183ff8 100644
--- a/backend/src/middleware/cors.ts
+++ b/backend/src/middleware/cors.ts
@@ -1,10 +1,14 @@
 import cors from "cors";
 
+// Regex cobre qualquer preview do Vercel: painel-vagas-*.vercel.app
+// (hash-based e branch-based, ex: git-master-bene-teslas-projects)
+const VERCEL_PREVIEW_RE = /^https:\/\/painel-vagas-[a-z0-9-]+\.vercel\.app$/;
+
 const DEFAULT_ALLOWED_ORIGINS = [
   "https://painel-vagas-lake.vercel.app",
+  "https://painel-vagas-git-master-bene-teslas-projects.vercel.app",
   "https://painel-vagas-m6hbzlqeh-bene-teslas-projects.vercel.app",
   "https://jobsglobalscraper.ddns.net",
-  "http://jobsglobalscraper.ddns.net",
   "http://localhost:5173",
   "http://localhost:5174",
 ];
@@ -19,14 +23,17 @@ function parseAllowedOrigins(value: string | undefined): Set<string> {
 
 export const corsOptions: cors.CorsOptions = {
   origin(origin, callback) {
-    const allowedOrigins = parseAllowedOrigins(
-      process.env.CORS_ALLOWED_ORIGINS,
-    );
-    if (!origin || allowedOrigins.has(origin)) return callback(null, true);
+    if (!origin) return callback(null, true);
+
+    if (VERCEL_PREVIEW_RE.test(origin)) return callback(null, true);
+
+    const allowedOrigins = parseAllowedOrigins(process.env.CORS_ALLOWED_ORIGINS);
+    if (allowedOrigins.has(origin)) return callback(null, true);
+
     callback(new Error("Origin not allowed by CORS"));
   },
-  methods: ["GET", "POST", "OPTIONS"],
-  allowedHeaders: ["Content-Type", "Authorization"],
+  methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
+  allowedHeaders: ["Content-Type", "Authorization", "X-Requested-With"],
   credentials: true,
   maxAge: 86400,
 };
diff --git a/vercel.json b/vercel.json
index a2cc74d..d45c354 100644
--- a/vercel.json
+++ b/vercel.json
@@ -2,7 +2,7 @@
   "rewrites": [
     {
       "source": "/api/(.*)",
-      "destination": "http://jobsglobalscraper.ddns.net/api/$1"
+      "destination": "https://jobsglobalscraper.ddns.net/api/$1"
     },
     {
       "source": "/((?!api/).*)",