From 741692c7d76859731f3842a5cd2bb853ee8cf0ed Mon Sep 17 00:00:00 2001
From: Giuliano Silvestro <giuliano.silvestro@icloud.com>
Date: Wed, 20 May 2026 18:09:13 +1000
Subject: [PATCH] Broaden dev CORS to any localhost port

skyai-cloud's Vite dev server hops ports (5173 -> 5174 -> ...) when one
is taken, so a fixed localhost:5173 allowlist breaks the browser's
cross-origin calls. Allow any http://localhost:<port> in dev; the
*.sky-ai.com rule is unchanged for deployed origins.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 lib/arcadia_cloud_web/endpoint.ex | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/arcadia_cloud_web/endpoint.ex b/lib/arcadia_cloud_web/endpoint.ex
index 9e352ce..280e411 100644
--- a/lib/arcadia_cloud_web/endpoint.ex
+++ b/lib/arcadia_cloud_web/endpoint.ex
@@ -48,7 +48,8 @@ defmodule ArcadiaCloudWeb.Endpoint do
 
   plug CORSPlug,
     origin: [
-      "http://localhost:5173",
+      # any localhost port — Vite dev servers hop ports when one is taken
+      ~r{^http://localhost:\d+$},
       ~r{^https://.*\.sky-ai\.com$}
     ]