fix: cors

main.py

@@ -1,12 +1,40 @@
+import os
+
 import httpx
+from dotenv import load_dotenv
 from fastapi import FastAPI, HTTPException
 from openai import APITimeoutError
+from fastapi.middleware.cors import CORSMiddleware
 
 from schemas import RoutePlanRequest, RoutePlanResult
 from agent import ConfigurationError, GuardrailError, run_route_plan
 
+load_dotenv()
+
+
+def _csv_env(name: str, default: str) -> list[str]:
+    raw_value = os.getenv(name, default)
+    return [item.strip() for item in raw_value.split(",") if item.strip()]
+
+
+def _bool_env(name: str, default: bool) -> bool:
+    raw_value = os.getenv(name, "true" if default else "false").strip().lower()
+    return raw_value in {"1", "true", "yes", "on"}
+
 app = FastAPI(title="Geo Route Agent", version="0.1.0")
 
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=_csv_env("CORS_ALLOW_ORIGINS", "http://localhost,http://127.0.0.1"),
+    allow_origin_regex=os.getenv(
+        "CORS_ALLOW_ORIGIN_REGEX",
+        r"https?://(localhost|127\.0\.0\.1)(:\d+)?$",
+    ),
+    allow_credentials=_bool_env("CORS_ALLOW_CREDENTIALS", False),
+    allow_methods=_csv_env("CORS_ALLOW_METHODS", "GET,POST,OPTIONS"),
+    allow_headers=_csv_env("CORS_ALLOW_HEADERS", "*"),
+)
+
 
 @app.post("/route/plan", response_model=RoutePlanResult)
 async def route_plan(request: RoutePlanRequest) -> RoutePlanResult: