@studious-lms/server 1.4.1 → 1.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@studious-lms/server",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "description": "Backend server for Studious application",
   "main": "dist/exportType.js",
   "types": "dist/exportType.d.ts",

package/prisma/migrations/20260410124000_add_submission_recommendation_state/migration.sql

@@ -0,0 +1,14 @@
+-- CreateEnum
+CREATE TYPE "SubmissionRecommendationState" AS ENUM ('NONE', 'OPEN', 'ASSIGNED', 'DISMISSED');
+
+-- AlterTable
+ALTER TABLE "Submission"
+  ADD COLUMN "recommendationState" "SubmissionRecommendationState" NOT NULL DEFAULT 'NONE',
+  ADD COLUMN "recommendationUpdatedAt" TIMESTAMP(3),
+  ADD COLUMN "targetedAssignmentId" TEXT;
+
+-- CreateIndex
+CREATE INDEX "Submission_studentId_recommendationState_idx" ON "Submission"("studentId", "recommendationState");
+
+-- AddForeignKey
+ALTER TABLE "Submission" ADD CONSTRAINT "Submission_targetedAssignmentId_fkey" FOREIGN KEY ("targetedAssignmentId") REFERENCES "Assignment"("id") ON DELETE SET NULL ON UPDATE CASCADE;

package/prisma/migrations/20260415103500_add_session_type/migration.sql

@@ -0,0 +1,33 @@
+-- CreateEnum
+CREATE TYPE "SessionType" AS ENUM ('AUTH', 'EMAIL_VERIFICATION', 'PASSWORD_RESET', 'CLASS_INVITE');
+
+-- AlterTable
+ALTER TABLE "Session"
+  ADD COLUMN "type" "SessionType" NOT NULL DEFAULT 'AUTH';
+
+-- Backfill existing non-auth session records when they can be inferred safely.
+UPDATE "Session"
+SET "type" = 'CLASS_INVITE'
+WHERE "classId" IS NOT NULL;
+
+-- This Session.type backfill uses the expiresAt <= NOW() + INTERVAL '2 hours'
+-- heuristic to identify password reset tokens. It may misclassify rare short-lived
+-- AUTH sessions, but this one-time migration safely fails those sessions until users re-login.
+UPDATE "Session"
+SET "type" = 'PASSWORD_RESET'
+WHERE "userId" IS NOT NULL
+  AND "classId" IS NULL
+  AND "expiresAt" IS NOT NULL
+  AND "expiresAt" <= NOW() + INTERVAL '2 hours';
+
+UPDATE "Session"
+SET "type" = 'EMAIL_VERIFICATION'
+WHERE "userId" IS NOT NULL
+  AND "classId" IS NULL
+  AND "type" = 'AUTH'
+  AND EXISTS (
+    SELECT 1
+    FROM "User"
+    WHERE "User"."id" = "Session"."userId"
+      AND "User"."verified" = false
+  );

package/prisma/migrations/20260415133000_add_ai_usage_logs/migration.sql

@@ -0,0 +1,19 @@
+CREATE TABLE "AiUsageLog" (
+    "id" TEXT NOT NULL,
+    "reason" TEXT NOT NULL,
+    "provider" TEXT NOT NULL DEFAULT 'openai',
+    "model" TEXT NOT NULL,
+    "operation" TEXT NOT NULL,
+    "success" BOOLEAN NOT NULL DEFAULT true,
+    "promptTokens" INTEGER,
+    "completionTokens" INTEGER,
+    "totalTokens" INTEGER,
+    "estimatedInputTokens" INTEGER,
+    "metadata" JSONB DEFAULT '{}'::jsonb,
+    "error" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "AiUsageLog_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX "AiUsageLog_reason_createdAt_idx" ON "AiUsageLog"("reason", "createdAt");

package/prisma/schema.prisma

@@ -74,6 +74,13 @@ enum ReactionType {
   HAPPY
 }
 
+enum SubmissionRecommendationState {
+  NONE
+  OPEN
+  ASSIGNED
+  DISMISSED
+}
+
 model School {
   id          String      @id @default(uuid())
   name        String
@@ -292,6 +299,7 @@ model Assignment {
   gradingBoundary GradingBoundary? @relation(fields: [gradingBoundaryId], references: [id], onDelete: Cascade)
   gradingBoundaryId String?
   worksheets Worksheet[] @relation("AssignmentWorksheets")
+  targetedBySubmissions Submission[] @relation("SubmissionTargetedAssignment")
 }
 
 
@@ -361,6 +369,10 @@ model Submission {
   worksheetResponses StudentWorksheetResponse[]
   extendedResponse String?
   gradeReceived Int?
+  recommendationState SubmissionRecommendationState @default(NONE)
+  recommendationUpdatedAt DateTime?
+  targetedAssignmentId String?
+  targetedAssignment Assignment? @relation("SubmissionTargetedAssignment", fields: [targetedAssignmentId], references: [id], onDelete: SetNull)
 
   rubricState String?
   teacherComments String?
@@ -369,6 +381,8 @@ model Submission {
   submitted   Boolean? @default(false)
   returned    Boolean? @default(false)
   newtonTutors NewtonChat[]
+
+  @@index([studentId, recommendationState])
 }
 
 model NewtonChat {
@@ -392,10 +406,18 @@ model Section {
   order Int?
 }
 
+enum SessionType {
+  AUTH
+  EMAIL_VERIFICATION
+  PASSWORD_RESET
+  CLASS_INVITE
+}
+
 model Session {
   id        String @id @default(uuid())
   createdAt DateTime? @default(now())
   expiresAt DateTime?
+  type      SessionType @default(AUTH)
   userId    String?
   user      User? @relation(fields: [userId], references: [id], onDelete: NoAction)
   classId   String?
@@ -514,6 +536,24 @@ model Message {
   meta Json? @default("{}")
 }
 
+model AiUsageLog {
+  id                  String   @id @default(uuid())
+  reason              String
+  provider            String   @default("openai")
+  model               String
+  operation           String
+  success             Boolean  @default(true)
+  promptTokens        Int?
+  completionTokens    Int?
+  totalTokens         Int?
+  estimatedInputTokens Int?
+  metadata            Json?    @default("{}")
+  error               String?
+  createdAt           DateTime @default(now())
+
+  @@index([reason, createdAt])
+}
+
 model Mention {
   id String @id @default(uuid())
   messageId String
@@ -621,4 +661,4 @@ model EarlyAccessRequest {
   email String
   createdAt DateTime @default(now())
   institutionSize String
-}
+}

package/scripts/test-pre-push.ts

@@ -7,8 +7,12 @@ dotenv.config({ path: resolve(process.cwd(), '.env.test') });
 
 logger.info("Syncing Prisma schema to test database...");
 
-execSync("npx prisma db push --force-reset --skip-generate", {
+if (process.env.DATABASE_URL?.includes("supabase")) {
+  logger.error("Supabase is not supported for test database, please don't clear the production database");
+  process.exit(1);
+}
+else execSync("npx prisma db push --force-reset --skip-generate", {
   stdio: 'inherit',
 });
 
-logger.info("Test database is ready!");
+logger.info("Test database run has completed");

package/src/index.ts

@@ -7,12 +7,15 @@ import dotenv from 'dotenv';
 import { createExpressMiddleware } from '@trpc/server/adapters/express';
 import { appRouter } from './routers/_app.js';
 import { createTRPCContext, createCallerFactory } from './trpc.js';
+import { findUserBySessionToken } from './models/auth.js';
 import { logger } from './utils/logger.js';
 import { setupSocketHandlers } from './socket/handlers.js';
 import { bucket } from './lib/googleCloudStorage.js';
+import { validateDirectUploadIntent } from './lib/fileUpload.js';
 import { prisma } from './lib/prisma.js';
 import { pusher } from './lib/pusher.js';
 import { connectRedis, disconnectRedis } from './lib/redis.js';
+import { createCorsOriginMatcher } from './lib/config/cors.js';
 
 import { authLimiter, generalLimiter, helmetConfig, uploadLimiter } from './middleware/security.js';
 
@@ -27,6 +30,8 @@ import { openAIClient } from './utils/inference.js';
 
 const app = express();
 
+app.set('trust proxy', 1);
+
 app.use(helmetConfig);
 app.use(compression());
 app.use(express.json());
@@ -38,34 +43,24 @@ app.use((req, res, next) => {
   next();
 });
 
-const allowedOrigins = env.NODE_ENV === 'production'
-? [
-    'https://www.studious.sh',
-    'https://studious.sh',
-    'https://dev.studious.sh',
-    'https://www.dev.studious.sh',
-    env.NEXT_PUBLIC_APP_URL,
-    'http://localhost:3000',
-
-  ].filter(Boolean)
-: [
-    'http://localhost:3000',
-    'http://localhost:3001',
-    'http://127.0.0.1:3000',
-    'http://127.0.0.1:3001',
-
-    env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
-  ];
+const { allowedOrigins, allowedOriginPatterns, isAllowedOrigin } = createCorsOriginMatcher(env);
 
 // CORS middleware
 app.use(cors({
-  origin: allowedOrigins,
+  origin: (origin, callback) => {
+    if (!origin || isAllowedOrigin(origin)) {
+      callback(null, true);
+      return;
+    }
+
+    logger.warn('CORS origin rejected', { origin, allowedOrigins });
+    callback(null, false);
+  },
   credentials: true,
   methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
   allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With', 'x-user'],
-  preflightContinue: false, // Important: stop further handling of OPTIONS
-  optionsSuccessStatus: 204, // Recommended for modern browsers
-
+  preflightContinue: false,
+  optionsSuccessStatus: 204,
 }));
 
 app.use(generalLimiter);
@@ -122,6 +117,17 @@ app.use((req, res, next) => {
 // Create HTTP server
 const httpServer = createServer(app);
 
+app.get('/', async (req, res) => {
+  res.status(200).json({ 
+    status: 'OK',
+    timestamp: new Date().toISOString(),
+    uptime: process.uptime(),
+    version: process.env.npm_package_version,
+    environment: process.env.NODE_ENV,
+    appUrl: process.env.NEXT_PUBLIC_APP_URL,
+  });
+});
+
 app.get('/health', async (req, res) => {
 
   try {
@@ -163,10 +169,7 @@ app.post('/api/pusher/auth', async (req, res) => {
       return res.status(401).json({ error: 'Authentication required' });
     }
 
-    const user = await prisma.user.findFirst({
-      where: { sessions: { some: { id: token } } },
-      select: { id: true, username: true },
-    });
+    const user = await findUserBySessionToken(token);
 
     if (!user) {
       return res.status(401).json({ error: 'Invalid or expired session' });
@@ -243,15 +246,9 @@ app.post('/api/pusher/auth', async (req, res) => {
 // Setup Socket.IO
 const io = new Server(httpServer, {
   cors: {
-    origin: [
-      'http://localhost:3000',  // Frontend development server
-      'http://localhost:3001',  // Server port
-      'http://127.0.0.1:3000',  // Alternative localhost
-      'http://127.0.0.1:3001',  // Alternative localhost
-      'https://www.studious.sh',  // Production frontend
-      'https://studious.sh',     // Production frontend (without www)
-      env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
-    ],
+    origin: (origin, callback) => {
+      callback(null, !origin || isAllowedOrigin(origin));
+    },
     methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
     credentials: true,
     allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With', 'Access-Control-Allow-Origin', 'x-user']
@@ -287,19 +284,7 @@ app.get('/api/files/:fileId', async (req, res) => {
     const token = typeof userHeader === 'string' ? userHeader : userHeader[0];
 
     // Find user by session token
-    const user = await prisma.user.findFirst({
-      where: {
-        sessions: {
-          some: {
-            id: token
-          }
-        }
-      },
-      select: {
-        id: true,
-        username: true,
-      }
-    });
+    const user = await findUserBySessionToken(token);
 
     if (!user) {
       return res.status(401).json({ error: 'Invalid or expired session' });
@@ -476,55 +461,92 @@ app.get('/api/files/:fileId', async (req, res) => {
 app.use('/trpc/auth.login', authLimiter);
 app.use('/trpc/auth.register', authLimiter);
 
+async function getAuthenticatedRequestUser(req: Request) {
+  const userHeader = req.headers['x-user'];
+  const tokenFromUserHeader = typeof userHeader === 'string' ? userHeader : userHeader?.[0];
+  const authorizationHeader = req.headers.authorization;
+  const tokenFromAuthorization =
+    typeof authorizationHeader === 'string' && authorizationHeader.startsWith('Bearer ')
+      ? authorizationHeader.slice(7)
+      : null;
+
+  let token = tokenFromUserHeader ?? tokenFromAuthorization;
+
+  if (!token && req.headers.cookie) {
+    const cookieName = env.PUSHER_AUTH_COOKIE_NAME || 'token';
+    const match = req.headers.cookie.match(new RegExp(cookieName + '=([^;]+)'));
+    token = match?.[1]?.trim() ?? null;
+  }
+
+  if (!token) {
+    return null;
+  }
+
+  return findUserBySessionToken(token);
+}
+
+function getUploadSessionId(req: Request) {
+  const queryValue = req.query.uploadSessionId;
+  if (typeof queryValue === 'string' && queryValue.trim()) {
+    return queryValue;
+  }
+
+  const headerValue = req.headers['x-upload-session-id'];
+  return typeof headerValue === 'string' ? headerValue : headerValue?.[0];
+}
+
 // File upload endpoint for secure file uploads (supports both POST and PUT)
 app.post('/api/upload/:filePath', uploadLimiter, async (req, res) => {
-  handleFileUpload(req, res);
+  await handleFileUpload(req, res);
 });
 
 app.put('/api/upload/:filePath', uploadLimiter, async (req, res) => {
-  handleFileUpload(req, res);
+  await handleFileUpload(req, res);
 });
 
-function handleFileUpload(req: any, res: any) {
+async function handleFileUpload(req: Request, res: Response) {
   try {
     const filePath = decodeURIComponent(req.params.filePath);
     
     // Set CORS headers for upload endpoint
     const origin = req.headers.origin;
-    const allowedOrigins = [
-      'http://localhost:3000',
-      'http://localhost:3001', 
-      'http://127.0.0.1:3000',
-      'http://127.0.0.1:3001',
-      'https://www.studious.sh',  // Production frontend
-      'https://studious.sh',     // Production frontend (without www)
-      env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
-    ];
     
-    if (origin && allowedOrigins.includes(origin)) {
+    if (origin && !isAllowedOrigin(origin)) {
+      return res.status(403).json({ error: 'Origin not allowed' });
+    }
+
+    if (origin) {
       res.header('Access-Control-Allow-Origin', origin);
-    } else {
-      res.header('Access-Control-Allow-Origin', 'http://localhost:3000');
     }
     
     res.header('Access-Control-Allow-Credentials', 'true');
+
+    const user = await getAuthenticatedRequestUser(req);
+    if (!user) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+
+    const uploadSessionId = getUploadSessionId(req);
+    if (!uploadSessionId) {
+      return res.status(401).json({ error: 'Upload session is required' });
+    }
+
+    await validateDirectUploadIntent({
+      filePath,
+      uploadSessionId,
+      userId: user.id,
+    });
     
-    // Get content type from headers
     const contentType = req.headers['content-type'] || 'application/octet-stream';
-    
-    // Create a new file in the bucket
     const file = bucket.file(filePath);
-    
-    // Create a write stream to Google Cloud Storage
     const writeStream = file.createWriteStream({
       metadata: {
         contentType,
       },
     });
     
-    // Handle stream events
     writeStream.on('error', (error) => {
-      logger.error('Error uploading file:', {error});
+      logger.error('Error uploading file:', {error, filePath, userId: user.id});
       if (!res.headersSent) {
         res.status(500).json({ error: 'Error uploading file' });
       }
@@ -538,11 +560,21 @@ function handleFileUpload(req: any, res: any) {
       });
     });
     
-    // Pipe the request body to the write stream
     req.pipe(writeStream);
     
   } catch (error) {
     logger.error('Error handling file upload:', {error});
+    const code = typeof error === 'object' && error && 'code' in error ? error.code : null;
+    const message = error instanceof Error ? error.message : 'Internal server error';
+
+    if (code === 'FORBIDDEN') {
+      return res.status(403).json({ error: message });
+    }
+
+    if (code === 'BAD_REQUEST') {
+      return res.status(400).json({ error: message });
+    }
+
     res.status(500).json({ error: 'Internal server error' });
   }
 }
@@ -550,6 +582,19 @@ function handleFileUpload(req: any, res: any) {
 // Create caller
 const createCaller = createCallerFactory(appRouter);
 
+// Fallback OPTIONS handler — prevents tRPC from rejecting preflight requests
+// when the cors middleware passes through without ending the response.
+app.options('/trpc/*', (req, res) => {
+  const origin = req.headers.origin;
+  if (origin && isAllowedOrigin(origin)) {
+    res.setHeader('Access-Control-Allow-Origin', origin);
+    res.setHeader('Access-Control-Allow-Credentials', 'true');
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With, x-user');
+  }
+  res.sendStatus(204);
+});
+
 // Setup tRPC middleware
 app.use(
   '/trpc',
@@ -594,13 +639,8 @@ logger.info('Configurations', {
 
 // Log CORS configuration
 logger.info('CORS Configuration', {
-  allowedOrigins: [
-    'http://localhost:3000',
-    'http://localhost:3001', 
-    'http://127.0.0.1:3000',
-    'http://127.0.0.1:3001',
-    env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
-  ]
+  allowedOrigins,
+  allowedOriginPatterns: allowedOriginPatterns.map((pattern) => pattern.source),
 });
 
 const gracefulShutdown = (signal: string) => {
@@ -632,4 +672,4 @@ const gracefulShutdown = (signal: string) => {
 };
 
 process.on('SIGTERM', () => gracefulShutdown('SIGTERM'));
-process.on('SIGINT', () => gracefulShutdown('SIGINT'));
+process.on('SIGINT', () => gracefulShutdown('SIGINT'));

package/src/lib/config/cors.ts

@@ -0,0 +1,96 @@
+type CorsEnv = {
+  NODE_ENV?: 'development' | 'production' | 'test';
+  NEXT_PUBLIC_APP_URL?: string;
+  CORS_ALLOWED_ORIGINS?: string;
+  CORS_ALLOWED_ORIGIN_PATTERNS?: string;
+};
+
+const productionOrigins = [
+  'https://www.studious.sh',
+  'https://studious.sh',
+  'https://dev.studious.sh',
+  'https://www.dev.studious.sh',
+];
+
+const nonProductionOrigins = [
+  'http://localhost:3000',
+  'http://localhost:3001',
+  'http://127.0.0.1:3000',
+  'http://127.0.0.1:3001',
+];
+const MAX_PATTERN_LENGTH = 200;
+// This heuristic only targets common nested-quantifier cases like `(a+)+`.
+// It does not catch every risky construct (for example `.*.*` or deep alternation nesting),
+// so `parseCorsOriginPatterns` should still be limited to operator-controlled, anchored patterns.
+const SUSPICIOUS_QUANTIFIER_PATTERN = /(\([^)]*[+*{][^)]*\)|\[[^\]]+[+*{][^\]]*\])[+*{]/;
+
+const parseList = (value?: string) =>
+  value
+    ?.split(',')
+    .map((item) => item.trim())
+    .filter(Boolean) ?? [];
+
+const isDefined = <T>(value: T | undefined | null): value is T => Boolean(value);
+
+const toCorsOrigin = (value: string) => {
+  try {
+    return new URL(value).origin;
+  } catch {
+    return value.replace(/\/+$/, '');
+  }
+};
+
+export const parseCorsOrigins = (origins?: string) =>
+  parseList(origins).map(toCorsOrigin);
+
+const validateCorsOriginPattern = (pattern: string) => {
+  if (pattern.length > MAX_PATTERN_LENGTH) {
+    throw new Error(`CORS pattern exceeds maximum length of ${MAX_PATTERN_LENGTH}`);
+  }
+
+  // Prefer short, anchored patterns and avoid other complex regex features even if they pass this check.
+  if (SUSPICIOUS_QUANTIFIER_PATTERN.test(pattern)) {
+    throw new Error("CORS pattern contains nested or ambiguous quantifiers");
+  }
+
+  return pattern;
+};
+
+// Patterns are operator-controlled and matched against bounded URL origins, so ReDoS risk is low.
+// Syntax validation does not guarantee safety; prefer anchored patterns and avoid nested quantifiers.
+export const parseCorsOriginPatterns = (patterns?: string) =>
+  parseList(patterns).map((pattern) => new RegExp(validateCorsOriginPattern(pattern)));
+
+export const isValidCorsOriginPatternList = (patterns?: string) => {
+  try {
+    parseCorsOriginPatterns(patterns);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+export const createCorsOriginMatcher = (env: CorsEnv) => {
+  const allowedOrigins = Array.from(new Set([
+    ...(env.NODE_ENV === 'production' ? productionOrigins : nonProductionOrigins),
+    env.NEXT_PUBLIC_APP_URL ? toCorsOrigin(env.NEXT_PUBLIC_APP_URL) : undefined,
+    ...parseCorsOrigins(env.CORS_ALLOWED_ORIGINS),
+  ].filter(isDefined)));
+
+  const allowedOriginPatterns = parseCorsOriginPatterns(env.CORS_ALLOWED_ORIGIN_PATTERNS);
+
+  const isAllowedOrigin = (origin?: string) => {
+    const corsOrigin = origin ? toCorsOrigin(origin) : undefined;
+
+    return Boolean(corsOrigin && (
+      allowedOrigins.includes(corsOrigin) ||
+      allowedOriginPatterns.some((pattern) => pattern.test(corsOrigin))
+    ));
+  };
+
+  return {
+    allowedOrigins,
+    allowedOriginPatterns,
+    isAllowedOrigin,
+  };
+};

package/src/lib/config/env.ts

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import dotenv from 'dotenv';
 import { resolve } from 'path';
 import { logger } from '../../utils/logger.js';
+import { isValidCorsOriginPatternList } from './cors.js';
 
 // Determine which env file to load based on NODE_ENV
 const nodeEnv = process.env.NODE_ENV || 'development';
@@ -23,6 +24,12 @@ dotenv.config({ path: envPath, override: true }); // Override with env-specific
 const isTest = nodeEnv === 'test';
 const isProduction = nodeEnv === 'production';
 
+const corsAllowedOriginsSchema = z.string().optional();
+const corsAllowedOriginPatternsSchema = z.string().optional().refine(
+  isValidCorsOriginPatternList,
+  { message: 'CORS_ALLOWED_ORIGIN_PATTERNS must contain valid regex patterns' }
+);
+
 // Base schema with required vars for all environments
 const baseSchema = z.object({
   NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
@@ -33,6 +40,8 @@ const baseSchema = z.object({
 // Production/development schema with all required vars
 const fullSchema = baseSchema.extend({
   NEXT_PUBLIC_APP_URL: z.string().url().default('http://localhost:3000'),
+  CORS_ALLOWED_ORIGINS: corsAllowedOriginsSchema,
+  CORS_ALLOWED_ORIGIN_PATTERNS: corsAllowedOriginPatternsSchema,
   BACKEND_URL: z.string().url().default('http://localhost:3001'),
   SENTRY_DSN: z.string().url().optional(),
   EMAIL_HOST: z.string().min(1, 'EMAIL_HOST is required'),
@@ -59,6 +68,8 @@ const fullSchema = baseSchema.extend({
 // Test schema - only require what's needed for tests
 const testSchema = baseSchema.extend({
   NEXT_PUBLIC_APP_URL: z.string().url().optional().default('http://localhost:3000'),
+  CORS_ALLOWED_ORIGINS: corsAllowedOriginsSchema,
+  CORS_ALLOWED_ORIGIN_PATTERNS: corsAllowedOriginPatternsSchema,
   BACKEND_URL: z.string().url().optional().default('http://localhost:3001'),
   SENTRY_DSN: z.string().url().optional(),
   EMAIL_HOST: z.string().optional().default('smtp.test.com'),
@@ -129,4 +140,4 @@ function validateEnv() {
 export const env = validateEnv();
 
 // Type-safe environment access
-export type Env = z.infer<typeof envSchema>;
+export type Env = z.infer<typeof envSchema>;