From bd3593fb4855f16d0154872f7e0faf27931f5bf4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Klaas=20B=C3=B6rgmann?= <klaas@boergmann.it>
Date: Tue, 21 Jul 2026 12:22:38 +0200
Subject: [PATCH] =?UTF-8?q?CORS=20f=C3=BCr=20Hallenplaner-API=20auf=20hall?=
 =?UTF-8?q?e.tkdduisburg.de=20erweitern?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 app.js | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/app.js b/app.js
index 710429e..e40b594 100644
--- a/app.js
+++ b/app.js
@@ -93,6 +93,21 @@ const pool = new Pool({
   connectionString: process.env.DATABASE_URL,
 });
 
+// CORS für Hallenplaner-API
+const ALLOWED_ORIGINS = ['https://halle.tkdduisburg.de'];
+app.use('/api/layouts', (req, res, next) => {
+  const origin = req.headers.origin;
+  if (ALLOWED_ORIGINS.includes(origin)) {
+    res.setHeader('Access-Control-Allow-Origin', origin);
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+  }
+  if (req.method === 'OPTIONS') {
+    return res.sendStatus(204);
+  }
+  next();
+});
+
 // Api für Hallenplaner
 app.get('/api/layouts', async (req, res) => {
   try {