Disable CORS by default for proxied previews

.env.example

@@ -1,7 +1,7 @@
 DEPLOY_IMAGE=pk-lab-server:local
 POSTGRES_PASSWORD=replace-with-a-long-random-value
 PUBLIC_BASE_URL=
-CORS_ORIGINS=http://localhost:3000,http://localhost:3002
+CORS_ORIGINS=
 TEST_AUTH_ENABLED=false
 XHS_HUB_APP_ID=
 XHS_HUB_APP_SECRET=

.gitea/workflows/docker-deploy.yml

@@ -21,7 +21,7 @@ jobs:
       SOURCE_REPOSITORY: ${{ gitea.repository }}
       SOURCE_REVISION: ${{ gitea.sha }}
       PUBLIC_BASE_URL: ${{ vars.PUBLIC_BASE_URL || '' }}
-      CORS_ORIGINS: ${{ vars.CORS_ORIGINS || 'http://localhost:3000,http://localhost:3002' }}
+      CORS_ORIGINS: ${{ vars.CORS_ORIGINS || '' }}
       TEST_AUTH_ENABLED: ${{ vars.TEST_AUTH_ENABLED || 'true' }}
       POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
       XHS_HUB_APP_ID: ${{ secrets.XHS_HUB_APP_ID }}

compose.yml

@@ -30,7 +30,7 @@ services:
     environment:
       DATABASE_URL: postgresql+psycopg://pk_lab:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}@postgres:5432/pk_lab
       PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-}
-      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:3000,http://localhost:3002}
+      CORS_ORIGINS: ${CORS_ORIGINS:-}
       TEST_AUTH_ENABLED: ${TEST_AUTH_ENABLED:-false}
       XHS_HUB_APP_ID: ${XHS_HUB_APP_ID:-}
       XHS_HUB_APP_SECRET: ${XHS_HUB_APP_SECRET:-}

docs/architecture.md

@@ -46,7 +46,7 @@ Variables：
 
 ### 两个前端
 
-综合版默认 `DEPLOY_PORT=3000`，独立版默认 `DEPLOY_PORT=3002`。预览默认使用同源 `/api`，无需配置 `API_BASE_URL`；仅跨域部署时覆盖该变量。
+综合版默认 `DEPLOY_PORT=3000`，独立版默认 `DEPLOY_PORT=3002`。预览固定使用同源 `/api`，不需要 `API_BASE_URL` 或 CORS 配置。
 
 ## 永久运行保证
 

src/pk_lab_server/config.py

@@ -9,7 +9,7 @@ class Settings(BaseSettings):
 
     database_url: str = "sqlite:///./pk-lab.db"
     session_ttl_seconds: int = 60 * 60 * 24 * 30
-    cors_origins: str = "http://localhost:3000,http://localhost:3002"
+    cors_origins: str = ""
     public_base_url: str = ""
     test_auth_enabled: bool = False
     xhs_token_url: str = "https://miniapp.xiaohongshu.com/api/rmp/token"