fixed page state while generating a message

backend/src/app.js

@@ -17,23 +17,26 @@ import supabaseAuth, { optionalAuth } from "./middleware/supabaseAuth.js";
 dotenv.config();
 
 const app = express();
-const CORS_ORIGIN = process.env.CORS_ORIGIN || "http://localhost:5173";
+const CORS_ORIGINS = (process.env.CORS_ORIGIN || "http://localhost:5173")
+ .split(",")
+ .map((origin) => origin.trim())
+ .filter(Boolean);
 
 // Trust proxy hop count so req.ip (and therefore rate limiting) sees the real
 // client IP behind a reverse proxy. Off by default; set TRUST_PROXY=1 in prod.
 if (process.env.TRUST_PROXY) {
-  app.set("trust proxy", process.env.TRUST_PROXY);
+ app.set("trust proxy", process.env.TRUST_PROXY);
 }
 
 // Middleware
 app.use(securityHeaders);
 app.use(cookieParser());
 app.use(express.json());
-app.use(cors({ origin: CORS_ORIGIN, credentials: true }));
+app.use(cors({ origin: CORS_ORIGINS, credentials: true }));
 
 // Health check
 app.get("/health", (_req, res) => {
-  res.json({ status: "ok", provider: process.env.AI_PROVIDER });
+ res.json({ status: "ok", provider: process.env.AI_PROVIDER });
 });
 
 // Auth routes — public endpoints (signup, signin, signout, me)
@@ -47,16 +50,16 @@ app.use("/api/sessions", sessionsLimiter, supabaseAuth, sessionRoutes);
 
 // 404 handler
 app.use((_req, res) => {
-  res.status(404).json({ error: "Endpoint not found" });
+ res.status(404).json({ error: "Endpoint not found" });
 });
 
 // Global error handler — never leak stack traces or internals to the client
 // (Express's default handler emits HTML stack dumps in non-production).
 // eslint-disable-next-line no-unused-vars
 app.use((err, _req, res, _next) => {
-  console.error("Unhandled error:", err?.message);
-  if (res.headersSent) return;
-  res.status(500).json({ error: "Internal server error" });
+ console.error("Unhandled error:", err?.message);
+ if (res.headersSent) return;
+ res.status(500).json({ error: "Internal server error" });
 });
 
-export default app;
+export default app;