fix: restrict OTC bridge CORS origins

otc-bridge/otc_bridge.py

@@ -40,6 +40,22 @@
 
 RUSTCHAIN_NODE = os.environ.get("RUSTCHAIN_NODE", "https://50.28.86.131")
 DB_PATH = os.environ.get("OTC_DB_PATH", "otc_bridge.db")
+DEFAULT_OTC_CORS_ORIGINS = ("https://bottube.ai", "https://rustchain.org")
+
+
+def _parse_cors_origins(raw_origins):
+    if raw_origins is None:
+        return list(DEFAULT_OTC_CORS_ORIGINS)
+
+    origins = [
+        origin.strip()
+        for origin in raw_origins.split(",")
+        if origin.strip() and origin.strip() != "*"
+    ]
+    return origins or list(DEFAULT_OTC_CORS_ORIGINS)
+
+
+OTC_CORS_ORIGINS = _parse_cors_origins(os.environ.get("OTC_CORS_ORIGINS"))
 
 # TLS verification: defaults to True (secure).
 # Set RUSTCHAIN_TLS_VERIFY=false only for local development with self-signed certs.
@@ -73,7 +89,7 @@
 logging.basicConfig(level=logging.INFO)
 
 app = Flask(__name__, static_folder="static")
-CORS(app)
+CORS(app, origins=OTC_CORS_ORIGINS)
 
 
 # ---------------------------------------------------------------------------

tests/test_otc_bridge_query_validation.py

@@ -5,14 +5,17 @@
 from pathlib import Path
 
 
-def load_otc_bridge(tmp_path):
-    if "flask_cors" not in sys.modules:
-        flask_cors = types.ModuleType("flask_cors")
-        flask_cors.CORS = lambda app: app
-        sys.modules["flask_cors"] = flask_cors
+def load_otc_bridge(tmp_path, cors_origins=None):
+    flask_cors = sys.modules.get("flask_cors") or types.ModuleType("flask_cors")
+    flask_cors.CORS = lambda app, **kwargs: app
+    sys.modules["flask_cors"] = flask_cors
 
     db_path = tmp_path / "otc_bridge.db"
     os.environ["OTC_DB_PATH"] = str(db_path)
+    if cors_origins is None:
+        os.environ.pop("OTC_CORS_ORIGINS", None)
+    else:
+        os.environ["OTC_CORS_ORIGINS"] = cors_origins
 
     module_path = Path(__file__).resolve().parents[1] / "otc-bridge" / "otc_bridge.py"
     spec = importlib.util.spec_from_file_location("otc_bridge_under_test", module_path)
@@ -23,6 +26,25 @@ def load_otc_bridge(tmp_path):
     return module
 
 
+def test_cors_defaults_to_restricted_public_origins(tmp_path):
+    otc_bridge = load_otc_bridge(tmp_path)
+
+    assert otc_bridge.OTC_CORS_ORIGINS == ["https://bottube.ai", "https://rustchain.org"]
+    assert "*" not in otc_bridge.OTC_CORS_ORIGINS
+
+
+def test_cors_env_ignores_wildcard_origin(tmp_path):
+    otc_bridge = load_otc_bridge(
+        tmp_path,
+        cors_origins="*, https://trusted.example, http://localhost:3000",
+    )
+
+    assert otc_bridge.OTC_CORS_ORIGINS == [
+        "https://trusted.example",
+        "http://localhost:3000",
+    ]
+
+
 def test_orders_rejects_malformed_pagination(tmp_path):
     otc_bridge = load_otc_bridge(tmp_path)