Server: Allow syncing with a web app instance hosted on a custom domain (#16760)

packages/server/src/app.ts

@@ -94,6 +94,23 @@ async function getEnvFilePath(env: Env, argv: { envFile?: string }): Promise<str
 	return '';
 }
 
+const getCorsAllowedDomains = (envVariables: EnvVariables, env: Env) => {
+	const corsAllowedDomains = envVariables.CORS_ALLOWED_DOMAINS
+		.split(',')
+		.map(domain => domain.trim())
+		.filter(domain => !!domain);
+
+	if (env === Env.Dev) {
+		// Stripe (dev)
+		corsAllowedDomains.push('http://localhost:8077');
+
+		// Web client (dev)
+		corsAllowedDomains.push('http://localhost:8088');
+	}
+
+	return corsAllowedDomains;
+};
+
 async function main() {
 	const { selectedCommand, argv: yargsArgv } = await setupCommands();
 
@@ -126,21 +143,8 @@ async function main() {
 	// loads the user, which is then used by notificationHandler. And finally
 	// routeHandler uses data from both previous middlewares. It would be good to
 	// layout these dependencies in code but not clear how to do this.
-	const corsAllowedDomains = [
-		'https://joplinapp.org',
-
-		// Allows sync with the web version of Joplin
-		'https://app.joplincloud.com',
-	];
-
-	if (env === Env.Dev) {
-		// Stripe (dev)
-		corsAllowedDomains.push('http://localhost:8077');
-
-		// Web client (dev)
-		corsAllowedDomains.push('http://localhost:8088');
-	}
 
+	const corsAllowedDomains = getCorsAllowedDomains(envVariables, env);
 	function acceptOrigin(origin: string): boolean {
 		// Origin can be string "null"
 		if (origin === 'null') return false;

packages/server/src/env.ts

@@ -59,6 +59,11 @@ const defaultEnvValues: EnvVariables = {
 	TERMS_URL: '',
 	PRIVACY_URL: '',
 
+	// Comma-separated list of trusted domains that can access server API.
+	// Use this to grant the Joplin web app access to Joplin Server.
+	// Entries must be in <protocol>://<domain> form (no trailing slash).
+	CORS_ALLOWED_DOMAINS: 'https://joplinapp.org,https://app.joplincloud.com',
+
 	// ==================================================
 	// Database config
 	// ==================================================
@@ -215,6 +220,7 @@ export interface EnvVariables {
 	JOPLINAPP_BASE_URL: string;
 	TERMS_URL: string;
 	PRIVACY_URL: string;
+	CORS_ALLOWED_DOMAINS: string;
 
 	DEFAULT_ADMIN_PASSWORD: string;