fix: allow cors interceptor

Signed-off-by: Innei <[email protected]>

apps/core/src/common/interceptors/allow-all-cors.interceptor.ts

@@ -3,6 +3,7 @@ import type {
   ExecutionContext,
   NestInterceptor,
 } from '@nestjs/common'
+import type { FastifyBizRequest } from '~/transformers/get-req.transformer'
 import type { FastifyReply } from 'fastify'
 
 import { RequestMethod } from '@nestjs/common'
@@ -11,6 +12,7 @@ export class AllowAllCorsInterceptor implements NestInterceptor {
   intercept(context: ExecutionContext, next: CallHandler<any>) {
     const handle = next.handle()
     const response: FastifyReply<any> = context.switchToHttp().getResponse()
+    const request: FastifyBizRequest = context.switchToHttp().getRequest()
     const allowedMethods = [
       RequestMethod.GET,
       RequestMethod.HEAD,
@@ -30,8 +32,9 @@ export class AllowAllCorsInterceptor implements NestInterceptor {
       'Expires',
       'Content-Type',
     ]
+    const host = request.headers.origin
     response.headers({
-      'Access-Control-Allow-Origin': '*',
+      'Access-Control-Allow-Origin': host,
       'Access-Control-Allow-Headers': allowedHeaders.join(','),
       'Access-Control-Allow-Methods': allowedMethods.join(','),
       'Access-Control-Max-Age': '86400',