Adjusted

server.js

@@ -17,29 +17,29 @@
  ***********************************************************************************************************************************************************************/
 require('dotenv').config();
 
-const express       = require('express');
-const cors          = require('cors');
-const cookieParser  = require('cookie-parser');
-const session       = require('express-session');
-const passport      = require('./config/passport.config');
-const sequelize     = require('./config/db.config');
+const express = require('express');
+const cors = require('cors');
+const cookieParser = require('cookie-parser');
+const session = require('express-session');
+const passport = require('./config/passport.config');
+const sequelize = require('./config/db.config');
 
 // ── Middleware ──────────────────────────────────────────────────────────────────
-const { globalLimiter }  = require('./middleware/rateLimiter.middleware');
+const { globalLimiter } = require('./middleware/rateLimiter.middleware');
 const { csrfErrorHandler } = require('./middleware/csrf.middleware');
 
 // ── Routes ─────────────────────────────────────────────────────────────────────
-const authRoutes   = require('./routes/auth.routes');
+const authRoutes = require('./routes/auth.routes');
 const clientRoutes = require('./routes/client/client.routes');
-const staffRoutes  = require('./routes/staff/staff.routes');
-const adminRoutes  = require('./routes/admin/admin.routes');
+const staffRoutes = require('./routes/staff/staff.routes');
+const adminRoutes = require('./routes/admin/admin.routes');
 
 // ── Models (ensure associations are loaded) ────────────────────────────────────
 require('./models/users/users.mdl');
 require('./models/users/user_sessions.mdl');
 require('./models/users/user_groups.mdl');
 
-const app  = express();
+const app = express();
 const PORT = process.env.PORT || 3000;
 
 // ──────────────────────────────────────────────────────────────────────────────
@@ -50,11 +50,26 @@ app.set('trust proxy', 1); // Required for rate-limiter behind proxies/load bala
 const allowedOrigins = (process.env.ALLOWED_ORIGINS || process.env.APP_URL || '*').split(',');
 
 app.use(cors({
-  origin:      (origin, callback) => {
+  origin: (origin, callback) => {
     if (!origin || allowedOrigins.includes(origin)) return callback(null, true);
     callback(new Error(`CORS: origin ${origin} not allowed`));
   },
   credentials: true,
+  preflightContinue: false,       // cors() handles OPTIONS and stops — don't pass to next()
+  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
+  allowedHeaders: [
+    'Content-Type',
+    'Authorization',
+    'Accept',
+    'Origin',
+    'X-Requested-With',
+    'csrf-token',
+    'x-csrf-token', 
+    'CSRF-Token',
+    'X-CSRF-Token',
+  ],
+  optionsSuccessStatus: 204,
+  maxAge: 86400,
 }));
 
 app.use(express.json());
@@ -63,10 +78,10 @@ app.use(cookieParser());
 
 // Session — used only by csurf; JWT handles auth state
 app.use(session({
-  secret:            process.env.SESSION_SECRET || 'change-me',
-  resave:            false,
+  secret: process.env.SESSION_SECRET || 'change-me',
+  resave: false,
   saveUninitialized: false,
-  cookie:            { secure: process.env.NODE_ENV === 'production', httpOnly: true, sameSite: 'strict' },
+  cookie: { secure: process.env.NODE_ENV === 'production', httpOnly: true, sameSite: 'strict' },
 }));
 
 app.use(passport.initialize());
@@ -77,10 +92,10 @@ app.use(globalLimiter);
 // ──────────────────────────────────────────────────────────────────────────────
 //  Routes
 // ──────────────────────────────────────────────────────────────────────────────
-app.use('/api/auth',   authRoutes);
+app.use('/api/auth', authRoutes);
 app.use('/api/client', clientRoutes);
 app.use('/api/staff', staffRoutes);
-app.use('/api/admin',  adminRoutes);
+app.use('/api/admin', adminRoutes);
 
 // Health check
 app.get('/api/health', (req, res) => {