Develop

backend/.env.example

@@ -1,5 +1,9 @@
 # Runtime
 NODE_ENV=production
+PORT=3001
+
+# CORS / frontend access
+CORS_ALLOWED_ORIGINS=https://painel-vagas-lake.vercel.app,http://localhost:5173,http://localhost:5174
 
 # LinkedIn search filters
 SEARCH_LOCATION=Brasil

backend/src/db/environment.json

@@ -1,5 +1,8 @@
 {
   "KEYWORDS": [
-    "Java"
+    "Java",
+    "Spring",
+    "RabbitMQ",
+    "Docker"
   ]
 }

backend/src/jobsApiApp.js

@@ -8,15 +8,59 @@ import { getConfig } from "./config.js";
 import { searchJobsWithCache } from "./pipeline/searchJobsWithCache.js";
 import { sources } from "./sources/index.js";
 
+const DEFAULT_ALLOWED_ORIGINS = [
+  "https://painel-vagas-lake.vercel.app",
+  "http://localhost:5173",
+  "http://localhost:5174",
+];
+
+function parseAllowedOrigins(value) {
+  const configuredOrigins = String(value ?? "")
+    .split(",")
+    .map((origin) => origin.trim())
+    .filter(Boolean);
+
+  return new Set(configuredOrigins.length > 0 ? configuredOrigins : DEFAULT_ALLOWED_ORIGINS);
+}
+
 /**
  * @param {{ outputDir?: string }} [options]
  */
 export function createJobsApiApp(options = {}) {
   const outputDir = options.outputDir ?? path.resolve(process.cwd(), "output");
+  const allowedOrigins = parseAllowedOrigins(process.env.CORS_ALLOWED_ORIGINS);
+  const corsOptions = {
+    origin(origin, callback) {
+      if (!origin || allowedOrigins.has(origin)) {
+        callback(null, true);
+        return;
+      }
+
+      callback(new Error("Origin not allowed by CORS"));
+    },
+    methods: ["GET", "POST", "OPTIONS"],
+    allowedHeaders: ["Content-Type"],
+    credentials: false,
+    maxAge: 86400,
+  };
   const app = express();
   let activeScraperRun = null;
 
-  app.use(cors());
+  app.disable("x-powered-by");
+  app.use(express.json({ limit: "16kb" }));
+  app.use((req, res, next) => {
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("X-Frame-Options", "DENY");
+    res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
+    res.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
+
+    if (req.secure || req.get("x-forwarded-proto") === "https") {
+      res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+    }
+
+    next();
+  });
+  app.use(cors(corsOptions));
   app.use(express.json());
 
   function listXlsxFiles() {
@@ -322,5 +366,15 @@ export function createJobsApiApp(options = {}) {
     }
   });
 
+  app.use((error, _req, res, next) => {
+    if (error?.message === "Origin not allowed by CORS") {
+      return res.status(403).json({
+        message: "Origem nao permitida.",
+      });
+    }
+
+    return next(error);
+  });
+
   return app;
 }

backend/src/server.js

@@ -13,6 +13,7 @@ const outputDir = process.env.ELECTRON_OUTPUT_DIR
   : path.resolve(process.cwd(), "output");
 
 const app = createJobsApiApp({ outputDir });
+app.set("trust proxy", 1);
 
 async function registerSwaggerDocs() {
   try {

backend/tests/integration/jobsApi.test.js

@@ -40,6 +40,28 @@ describe("jobs API", () => {
     const res = await request(app).get("/api/jobs/files").expect(200);
     expect(res.body.files).toEqual([]);
   });
+
+  it("permite CORS para o frontend oficial", async () => {
+    tmpDir = mkdtempSync(join(tmpdir(), "jobs-api-"));
+    const app = createJobsApiApp({ outputDir: tmpDir });
+    const res = await request(app)
+      .get("/api/health")
+      .set("Origin", "https://painel-vagas-lake.vercel.app")
+      .expect(200);
+
+    expect(res.headers["access-control-allow-origin"]).toBe("https://painel-vagas-lake.vercel.app");
+  });
+
+  it("bloqueia origens nao autorizadas", async () => {
+    tmpDir = mkdtempSync(join(tmpdir(), "jobs-api-"));
+    const app = createJobsApiApp({ outputDir: tmpDir });
+    const res = await request(app)
+      .get("/api/health")
+      .set("Origin", "https://malicioso.example")
+      .expect(403);
+
+    expect(res.body.message).toBe("Origem nao permitida.");
+  });
 
   it("GET /api/jobs retorna 404 quando nao ha planilhas", async () => {
     tmpDir = mkdtempSync(join(tmpdir(), "jobs-api-"));

backend/tests/unit/services/server.test.js

@@ -4,6 +4,7 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 const mocks = vi.hoisted(() => ({
   listen: vi.fn(),
   use: vi.fn(),
+  set: vi.fn(),
   createJobsApiApp: vi.fn(),
   consoleLog: vi.fn(),
   existsSync: vi.fn(),
@@ -16,6 +17,7 @@ const mocks = vi.hoisted(() => ({
 mocks.createJobsApiApp.mockReturnValue({
   listen: mocks.listen,
   use: mocks.use,
+  set: mocks.set,
 });
 
 mocks.expressStatic.mockReturnValue(mocks.staticMiddleware);
@@ -68,8 +70,8 @@ describe("server entry", () => {
     await importServerEntry();
 
     expect(mocks.createJobsApiApp).toHaveBeenCalledTimes(1);
-    expect(mocks.listen).toHaveBeenCalled();
-    expect(mocks.listen.mock.calls[0][0]).toBe(3100);
+    expect(mocks.set).toHaveBeenCalledWith("trust proxy", 1);
+    expect(mocks.listen).toHaveBeenCalled();    expect(mocks.listen.mock.calls[0][0]).toBe(3100);
     expect(typeof mocks.listen.mock.calls[0][1]).toBe("function");
 
     const onListen = mocks.listen.mock.calls[0][1];

frontend/.env.example

@@ -0,0 +1,5 @@
+# Frontend -> backend API endpoint for production deployments
+VITE_API_BASE_URL=https://jobsglobalscraper.ddns.net
+
+# Optional override for local dev when using the Vite proxy
+# VITE_API_PROXY_TARGET=http://localhost:3001

frontend/src/services/jobsService.ts

@@ -1,5 +1,28 @@
 import type { JobFile, JobsResponse } from "@/types/jobs";
 
+function normalizeBaseUrl(value: string | undefined): string {
+  return typeof value === "string" ? value.trim().replace(/\/+$/, "") : "";
+}
+
+function getApiBaseUrl(): string {
+  const configuredBaseUrl = normalizeBaseUrl(import.meta.env.VITE_API_BASE_URL);
+  if (configuredBaseUrl) {
+    return configuredBaseUrl;
+  }
+
+  if (typeof window !== "undefined" && window.location.hostname === "painel-vagas-lake.vercel.app") {
+    return "https://jobsglobalscraper.ddns.net";
+  }
+
+  return "";
+}
+
+function buildApiUrl(path: string): string {
+  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+  const baseUrl = getApiBaseUrl();
+  return baseUrl ? `${baseUrl}${normalizedPath}` : normalizedPath;
+}
+
 function buildError(message: unknown, fallback: string): Error {
   return new Error(typeof message === "string" && message ? message : fallback);
 }
@@ -15,7 +38,7 @@ function readMessage(payload: unknown): string | undefined {
 }
 
 export async function fetchJobFiles(): Promise<JobFile[]> {
-  const response = await fetch("/api/jobs/files");
+  const response = await fetch(buildApiUrl("/api/jobs/files"));
   const payload = (await response.json()) as { files?: unknown } & Record<string, unknown>;
 
   if (!response.ok) {
@@ -34,7 +57,7 @@ export async function fetchJobFiles(): Promise<JobFile[]> {
 
 export async function fetchJobsByFile(fileName: string): Promise<JobsResponse> {
   const suffix = fileName ? `?file=${encodeURIComponent(fileName)}` : "";
-  const response = await fetch(`/api/jobs${suffix}`);
+  const response = await fetch(buildApiUrl(`/api/jobs${suffix}`));
   const payload = (await response.json()) as Record<string, unknown>;
 
   if (!response.ok) {
@@ -50,7 +73,7 @@ export async function fetchJobsByFile(fileName: string): Promise<JobsResponse> {
 }
 
 export async function fetchKeywords(): Promise<string[]> {
-  const response = await fetch("/api/keywords");
+  const response = await fetch(buildApiUrl("/api/keywords"));
   const payload = (await response.json()) as { keywords?: unknown } & Record<string, unknown>;
 
   if (!response.ok) {
@@ -61,7 +84,7 @@ export async function fetchKeywords(): Promise<string[]> {
 }
 
 export async function saveKeywords(keywords: string[]): Promise<void> {
-  const response = await fetch("/api/keywords", {
+  const response = await fetch(buildApiUrl("/api/keywords"), {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
@@ -76,7 +99,7 @@ export async function saveKeywords(keywords: string[]): Promise<void> {
 }
 
 export async function runScraperRequest(): Promise<void> {
-  const response = await fetch("/api/scraper/run", {
+  const response = await fetch(buildApiUrl("/api/scraper/run"), {
     method: "POST",
   });
   const payload = (await response.json()) as Record<string, unknown>;

frontend/tests/unit/utils/jobsService.test.ts

@@ -4,6 +4,7 @@ import { afterEach, describe, expect, it, vi } from "vitest";
 describe("jobsService", () => {
   afterEach(() => {
     vi.restoreAllMocks();
+    vi.unstubAllEnvs();
   });
 
   it("retorna lista de arquivos", async () => {
@@ -16,6 +17,15 @@ describe("jobsService", () => {
     expect(files).toEqual([{ file: "vagas.xlsx" }]);
   });
 
+  it("usa a URL da VPS quando VITE_API_BASE_URL estiver configurada", async () => {
+    vi.stubEnv("VITE_API_BASE_URL", "https://jobsglobalscraper.ddns.net/");
+    const fetchMock = vi.fn(async () => ({ ok: true, json: async () => ({ files: [] }) }));
+    vi.stubGlobal("fetch", fetchMock);
+
+    await fetchJobFiles();
+    expect(fetchMock).toHaveBeenCalledWith("https://jobsglobalscraper.ddns.net/api/jobs/files");
+  });
+
   it("filtra entradas invalidas ao listar arquivos", async () => {
     vi.stubGlobal(
       "fetch",

frontend/vite.config.js

@@ -1,10 +1,10 @@
-import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
 import path from 'path'
 import { fileURLToPath } from 'url'
+import { defineConfig } from 'vite'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const apiProxyTarget = process.env.VITE_API_PROXY_TARGET || 'http://localhost:3001'
+const apiProxyTarget = process.env.VITE_API_PROXY_TARGET || process.env.VITE_API_BASE_URL || 'http://localhost:3001'
 
 // https://vite.dev/config/
 export default defineConfig({