feat: auto complete stock change

flower/settings.py

@@ -49,6 +49,28 @@ DEBUG = env('DEBUG', default=False)
 ALLOWED_HOSTS = env.list('ALLOWED_HOSTS', default=[])
 
 
+# CORS 配置
+CORS_ALLOW_ALL_ORIGINS = DEBUG  # 开发环境允许所有源，生产环境需要配置白名单
+CORS_ALLOWED_ORIGINS = env.list('CORS_ALLOWED_ORIGINS', default=[
+    'http://localhost:3000',
+    'http://localhost:5173',
+    'http://127.0.0.1:3000',
+    'http://127.0.0.1:5173',
+])
+CORS_ALLOW_CREDENTIALS = True  # 允许携带凭证（如 Cookie、认证头）
+CORS_ALLOW_HEADERS = [
+    'accept',
+    'accept-encoding',
+    'authorization',
+    'content-type',
+    'dnt',
+    'origin',
+    'user-agent',
+    'x-csrftoken',
+    'x-requested-with',
+]
+
+
 # Application definition
 
 INSTALLED_APPS = [
@@ -59,6 +81,7 @@ INSTALLED_APPS = [
     'django.contrib.sessions',
     'django.contrib.messages',
     'django.contrib.staticfiles',  # 使用七牛云存储，不需要staticfiles app
+    'corsheaders',  # CORS 支持
     'rest_framework',
     'drf_spectacular',
     'basic_info',
@@ -70,6 +93,7 @@ INSTALLED_APPS = [
 MIDDLEWARE = [
     'django.middleware.security.SecurityMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
+    'corsheaders.middleware.CorsMiddleware',  # CORS 中间件，必须放在 CommonMiddleware 之前
     'django.middleware.common.CommonMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',