feat(cors): read allowed origins from CORS_ORIGINS env var

Allows deployments (e.g. the infra chart) to configure CORS origins
via a comma-separated CORS_ORIGINS env var instead of relying on the
hardcoded list. Falls back to the previous defaults when unset.

Author: offendingcommit

src/main.py

@@ -1,4 +1,5 @@
 import logging
+import os
 import re
 import uuid
 from collections.abc import Awaitable, Callable
@@ -168,9 +169,12 @@ async def lifespan(_: FastAPI):
 )
 
 origins = [
-    "http://localhost",
-    "http://127.0.0.1:8000",
-    "https://api.honcho.dev",
+    origin.strip()
+    for origin in os.getenv(
+        "CORS_ORIGINS",
+        "http://localhost,http://127.0.0.1:8000,https://api.honcho.dev",
+    ).split(",")
+    if origin.strip()
 ]
 
 app.add_middleware(