feat: allow cors

src/app.js

@@ -1,5 +1,6 @@
 require('./routes')
 const express = require('express')
+const cors = require('cors')
 const { routes } = require('./routes')
 const { maxAttachmentSize, basePath, trustProxy } = require('./config')
 
@@ -16,6 +17,11 @@ if (trustProxy) {
 app.use(express.json({ limit: maxAttachmentSize + 1000000 }))
 app.use(express.urlencoded({ limit: maxAttachmentSize + 1000000, extended: true }))
 
+app.use(cors({
+  origin: process.env.ALLOWED_ORIGINS?.split(',') || '*',
+  credentials: true
+}))
+
 // Mount routes with configurable base path
 app.use(basePath, routes)