From ed81f8bb6ebdea8ca136f2857b70d05710e0556c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=92=D0=B8=D0=BA=D1=82=D0=BE=D1=80?=
 <78488229+viktor138irk@users.noreply.github.com>
Date: Fri, 8 May 2026 20:52:57 +0900
Subject: [PATCH] =?UTF-8?q?CORS=20=D0=BF=D0=BE=D0=B4=D0=BA=D0=BB=D1=8E?=
 =?UTF-8?q?=D1=87=D0=B5=D0=BD=20=D0=BA=20=D1=80=D0=B0=D0=B7=D1=80=D0=B5?=
 =?UTF-8?q?=D1=88=D0=B5=D0=BD=D0=BD=D1=8B=D0=BC=20=D1=81=D0=B0=D0=B9=D1=82?=
 =?UTF-8?q?=D0=B0=D0=BC=20=D0=B2=D0=B8=D0=B4=D0=B6=D0=B5=D1=82=D0=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/src/server.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/backend/src/server.js b/backend/src/server.js
index 3506bc1..afdc3ec 100644
--- a/backend/src/server.js
+++ b/backend/src/server.js
@@ -10,6 +10,7 @@ import {
   getSiteByWidgetKey,
   getStats,
   getTelegramSettings,
+  isAllowedWidgetOrigin,
   listRecentMessages,
   migrate,
   touchVisitor,
@@ -35,8 +36,11 @@ const app = Fastify({
 await app.register(cors, {
   origin(origin, callback) {
     if (!origin) return callback(null, true);
-    const allowed = new Set([config.cors.adminOrigin, config.cors.widgetOrigin]);
-    callback(null, allowed.has(origin));
+
+    const staticAllowed = new Set([config.cors.adminOrigin, config.cors.widgetOrigin]);
+    const allowed = staticAllowed.has(origin) || isAllowedWidgetOrigin(origin);
+
+    callback(null, allowed);
   },
   credentials: true
 });