# Production Configuration Guide

## CORS Origins Configuration

The KPI Analysis application now supports configurable CORS origins for production deployments.

### Quick Setup

#### Option 1: Custom Domains (Recommended)
Add to your `.env` file:
```bash
CORS_ALLOW_ORIGINS=https://kpi.yourcompany.com https://app.yourcompany.com
```

#### Option 2: Auto-Detect from Server Host
Set your server host:
```bash
HOST=kpi.yourcompany.com
PORT=443
```

### Environment Examples

#### Single Domain Production
```bash
# .env - Single domain production
HOST=kpi.mapan.co.id
PORT=443
DEBUG=false
secret_key=your-production-secret-key

# The system will automatically add https://kpi.mapan.co.id to CORS origins
# Plus development origins for testing
```

#### Multiple Domains Production
```bash
# .env - Multiple domains
HOST=0.0.0.0
PORT=8000
DEBUG=false

# Explicitly define all allowed origins
CORS_ALLOW_ORIGINS=https://kpi.mapan.co.id https://analytics.mapan.co.id https://internal.mapan.co.id
```

#### Development with Production Testing
```bash
# .env - Development with production domains
HOST=127.0.0.1
PORT=8000
DEBUG=true

# Allow both local development and production domains
CORS_ALLOW_ORIGINS=http://localhost:8000 http://127.0.0.1:8000 https://kpi.mapan.co.id
```

### Configuration Variables

| Variable | Description | Example |
|----------|-------------|---------|
| `HOST` | Server host address | `kpi.mapan.co.id` |
| `PORT` | Server port | `443` (HTTPS) or `80` (HTTP) |
| `CORS_ALLOW_ORIGINS` | Custom CORS origins (space-separated) | `https://domain1.com https://domain2.com` |

### Default Behavior

**When `CORS_ALLOW_ORIGINS` is not set:**
- Uses default localhost development origins
- Automatically adds `http://localhost:{PORT}` and `http://127.0.0.1:{PORT}`
- If `HOST` is not localhost, adds `https://{HOST}` or `http://{HOST}` based on port

**When `CORS_ALLOW_ORIGINS` is set:**
- Uses only the specified origins
- No automatic additions are made

### Security Best Practices

1. **Always specify exact domains** in production
2. **Use HTTPS** for production deployments
3. **Avoid wildcard origins** (`*`) in production
4. **Test CORS** after configuration changes

### Testing CORS Configuration

#### Check Current Configuration
```python
from config.settings import settings
print("CORS Origins:", settings.effective_cors_origins)
```

#### Test CORS with curl
```bash
# Test preflight request
curl -X OPTIONS \
  -H "Origin: https://your-domain.com" \
  -H "Access-Control-Request-Method: POST" \
  -H "Access-Control-Request-Headers: Content-Type" \
  http://localhost:8000/api/auth/login
```

#### Expected Response Headers
```
Access-Control-Allow-Origin: https://your-domain.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: *
```

### Troubleshooting

#### CORS Error: "Access to fetch at '...' from origin '...' has been blocked"
1. Check that your domain is in `CORS_ALLOW_ORIGINS`
2. Verify the exact URL format (http vs https)
3. Ensure no extra spaces in the origin list

#### Cookie Issues in Production
1. Use `https://` URLs for production
2. Ensure `secure=True` is set for cookies
3. Check browser developer tools for detailed error messages

#### Development vs Production
```python
# Development - Auto-detected origins
if settings.debug:
    origins = settings.default_cors_origins
else:
    origins = settings.effective_cors_origins
```

### Migration from Hardcoded Origins

**Before (hardcoded):**
```python
allow_origins=[
    "http://localhost:3000", 
    "http://localhost:8000", 
    "http://127.0.0.1:8000",
    "http://localhost:8080"
]
```

**After (configurable):**
```python
allow_origins=settings.effective_cors_origins
```

This allows for seamless migration from development to production without code changes.