From 21de8d9eca16c6ffac14215434a6a1d293bf23fc Mon Sep 17 00:00:00 2001
From: Owen <owenrees.dev@gmail.com>
Date: Thu, 28 May 2026 15:17:45 +0200
Subject: [PATCH] allow all origins in dev mode and tie down to
 chess-scribe.org in prod

---
 Makefile    |  5 ++++
 _build/log  | 12 +++++++++-
 bin/dune    |  2 +-
 bin/main.ml | 66 +++++++++++++++++++++++++++++++++++++++++++++++++++--
 4 files changed, 81 insertions(+), 4 deletions(-)
 create mode 100644 Makefile

diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..654f606
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,5 @@
+run:
+	dune build && dune exec ./_build/default/bin/main.exe DREAM_ENV=production
+
+run-dev:
+	dune build && dune exec ./_build/default/bin/main.exe DREAM_ENV=development
\ No newline at end of file
diff --git a/_build/log b/_build/log
index 3b6f2d7..d2c8628 100644
--- a/_build/log
+++ b/_build/log
@@ -1,6 +1,16 @@
-# dune init project chess-scribe-api --kind=exec
+# dune exec ./_build/default/bin/main.exe DREAM_ENV=development
 # OCAMLPARAM: unset
 # Shared cache: enabled-except-user-rules
 # Shared cache location: /home/owen/.cache/dune/db
 # Workspace root: /home/owen/Desktop/chess-scribe-api
 # Auto-detected concurrency: 4
+# Dune context:
+#  { name = "default"
+#  ; kind = "default"
+#  ; profile = Dev
+#  ; merlin = true
+#  ; fdo_target_exe = None
+#  ; build_dir = In_build_dir "default"
+#  ; instrument_with = []
+#  }
+$ /home/owen/.opam/default/bin/ocamlc.opt -config > /tmp/dune_9bdbb8_output
diff --git a/bin/dune b/bin/dune
index 4d7ed10..f32a721 100644
--- a/bin/dune
+++ b/bin/dune
@@ -1,4 +1,4 @@
 (executable
  (public_name chess-scribe-api)
  (name main)
- (libraries chess_scribe_api dream pgn_to_tex))
+ (libraries chess_scribe_api dream pgn_to_tex yojson))
diff --git a/bin/main.ml b/bin/main.ml
index 145d657..2e8c7fd 100644
--- a/bin/main.ml
+++ b/bin/main.ml
@@ -1,6 +1,68 @@
+open Lwt.Syntax
+open Yojson.Safe.Util
+
+let is_dev_mode () =
+  Array.to_list Sys.argv
+  |> List.exists (fun arg -> arg = "DREAM_ENV=development")
+
+(* Custom CORS Middleware *)
+let cors_middleware next_handler request =
+  let allowed_origin =
+    if is_dev_mode () then "*" else "https://chess-scribe.org"
+  in
+
+  if Dream.method_ request = `OPTIONS then (
+    let response = Dream.response "" in
+    Dream.add_header response "Access-Control-Allow-Origin" allowed_origin;
+    Dream.add_header response "Access-Control-Allow-Methods"
+      "POST, GET, OPTIONS";
+    Dream.add_header response "Access-Control-Allow-Headers"
+      "Content-Type, Authorization";
+    Dream.set_status response `No_Content;
+    Lwt.return response)
+  else
+    (* 3. Pass normal requests through and append the origin header *)
+    let* response = next_handler request in
+    Dream.add_header response "Access-Control-Allow-Origin" allowed_origin;
+    Lwt.return response
+
+let handle_convert request =
+  let* body = Dream.body request in
+
+  try
+    let json = Yojson.Safe.from_string body in
+
+    let pgn = json |> member "pgn" |> to_string in
+    let diagram_clock = json |> member "diagramClock" |> to_bool in
+
+    (* For diagrams, we grab the raw sub-tree as a string to pass along later *)
+    let diagrams_json = json |> member "diagrams" in
+    let diagrams_str = Yojson.Safe.to_string diagrams_json in
+
+    print_endline "\n--- Received Request ---";
+    Printf.printf "PGN:\n%s\n\n" pgn;
+    Printf.printf "Diagrams JSON String: %s\n" diagrams_str;
+    Printf.printf "Diagram Clock: %b\n" diagram_clock;
+    print_endline "------------------------\n";
+
+    Dream.json {|{"status": "ok", "message": "Payload parsed successfully!"}|}
+  with
+  | Type_error (msg, _) ->
+      Dream.json ~status:`Bad_Request
+        (Printf.sprintf
+           {|{"type": "error", "message": "JSON structure error: %s"}|} msg)
+  | Yojson.Json_error msg ->
+      Dream.json ~status:`Bad_Request
+        (Printf.sprintf
+           {|{"type": "error", "message": "Invalid JSON syntax: %s"}|} msg)
+  | exn ->
+      Dream.json ~status:`Internal_Server_Error
+        (Printf.sprintf {|{"type": "error", "message": "%s"}|}
+           (Printexc.to_string exn))
+
 let () =
   Dream.run ~interface:"0.0.0.0" ~port:8080
-  @@ Dream.logger
+  @@ Dream.logger @@ cors_middleware
   @@ Dream.router
        [
          Dream.get "/" (fun request ->
@@ -8,7 +70,7 @@ let () =
          (* Health check (Exact match) *)
          Dream.get "/health" (fun _ -> Dream.respond "OK");
          (* Specific API Endpoints (Must be ABOVE the wildcard) *)
-         Dream.get "/api/v1/pdf" (fun _ -> Dream.html "Generate PDF");
+         Dream.post "/api/v1/pdf" handle_convert;
          (* Exact match for the docs root *)
          Dream.get "/api/v1" (fun request ->
              Dream.from_filesystem "static" "doc.html" request);