Allow CORS_ORIGINS to be configurable via the environment

Issue:
https://github.com/genenetwork/gn-gemtext-threads/blob/main/topics/gn1-migration-to-gn2/non-clustered-heatmaps-and-flipping.gmi

* gn3/app.py: setup CORS after all the configuration sources are loaded.
* gn3/settings.py: Parse CORS_ORIGINS from the environment variables.

  Enable the CORS_ORIGINS configuration to be set in the environment variables
  to give the application some flexibility when launching.

2 files changed, 16 insertions, 8 deletions

diff --git a/gn3/app.py b/gn3/app.py
index a25332c..3d68b3f 100644
--- a/gn3/app.py
+++ b/gn3/app.py
@@ -21,12 +21,6 @@ def create_app(config: Union[Dict, str, None] = None) -> Flask:
     # Load default configuration
     app.config.from_object("gn3.settings")
 
-    CORS(
-        app,
-        origins=app.config["CORS_ORIGINS"],
-        allow_headers=app.config["CORS_HEADERS"],
-        supports_credentials=True, intercept_exceptions=False)
-
     # Load environment configuration
     if "GN3_CONF" in os.environ:
         app.config.from_envvar('GN3_CONF')
@@ -37,6 +31,13 @@ def create_app(config: Union[Dict, str, None] = None) -> Flask:
             app.config.update(config)
         elif config.endswith(".py"):
             app.config.from_pyfile(config)
+
+    CORS(
+        app,
+        origins=app.config["CORS_ORIGINS"],
+        allow_headers=app.config["CORS_HEADERS"],
+        supports_credentials=True, intercept_exceptions=False)
+
     app.register_blueprint(general, url_prefix="/api/")
     app.register_blueprint(gemma, url_prefix="/api/gemma")
     app.register_blueprint(rqtl, url_prefix="/api/rqtl")
diff --git a/gn3/settings.py b/gn3/settings.py
index 150d96d..56ddaba 100644
--- a/gn3/settings.py
+++ b/gn3/settings.py
@@ -35,10 +35,17 @@ GENOTYPE_FILES = os.environ.get(
     "GENOTYPE_FILES", "{}/genotype_files/genotype".format(os.environ.get("HOME")))
 
 # CROSS-ORIGIN SETUP
-CORS_ORIGINS = [
+def parse_env_cors(default):
+    origins_str = os.environ.get("CORS_ORIGINS", None)
+    if origins_str:
+        return [
+            origin.strip() for origin in origins_str.split(",") if origin != ""]
+    return default
+
+CORS_ORIGINS = parse_env_cors([
     "http://localhost:*",
     "http://127.0.0.1:*"
-]
+])
 
 CORS_HEADERS = [
     "Content-Type",