Add CORS support for app.merabytes.com and local.merabytes.com

[Copilot]

The Lambda function needs to accept requests from multiple frontend domains: app.merabytes.com and local.merabytes.com in addition to the existing secrets.merabytes.com.

Changes

Dynamic origin validation

• Extract Origin header from requests (case-insensitive)
• Match against allowed origins whitelist
• Return matched origin in Access-Control-Allow-Origin response header
• Default to first allowed origin if no match

Configuration

• Default origins: secrets.merabytes.com, app.merabytes.com, local.merabytes.com
• Support comma-separated CORS_ORIGIN env var: https://app1.com,https://app2.com
• Filter empty strings and whitespace from parsed values

Implementation

# New helper functions
def _extract_origin(event):
    headers = event.get('headers', {})
    for key, value in headers.items():
        if key.lower() == 'origin':
            return value
    return None

def _get_cors_headers(origin=None):
    allowed_origin = ALLOWED_ORIGINS[0]
    if origin and origin in ALLOWED_ORIGINS:
        allowed_origin = origin
    return {"Access-Control-Allow-Origin": allowed_origin, ...}

# Applied at request start
def lambda_handler(event, context):
    origin = _extract_origin(event)
    CORS_HEADERS = _get_cors_headers(origin)
    # ... rest of handler

Backward compatible: existing single-origin configurations continue to work.

Original prompt

Add CORS support for app.merabytes.com and local.merabytes.com

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[kn0wm4d]

@copilot It has to support the three origins by default