From 572eda86257076e2b790e6f9f8bf3778d480c213 Mon Sep 17 00:00:00 2001
From: Shreerang Kale <shreerangkale@gmail.com>
Date: Fri, 25 Apr 2025 10:02:54 +0530
Subject: [PATCH] Update config to take comma separated list of allowed URLs

---
 .env.example                               | 2 +-
 src/screens/AutoSignIn.tsx                 | 4 +++-
 stack/stack-orchestrator/config/app/run.sh | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.env.example b/.env.example
index d563968..49a4f5f 100644
--- a/.env.example
+++ b/.env.example
@@ -5,4 +5,4 @@ REACT_APP_DEFAULT_GAS_PRICE=0.025
 REACT_APP_GAS_ADJUSTMENT=2
 REACT_APP_LACONICD_RPC_URL=https://laconicd-sapo.laconic.com
 
-REACT_APP_DEPLOY_APP_URL=
+REACT_APP_ALLOWED_URLS=
diff --git a/src/screens/AutoSignIn.tsx b/src/screens/AutoSignIn.tsx
index d9ab05b..a791230 100644
--- a/src/screens/AutoSignIn.tsx
+++ b/src/screens/AutoSignIn.tsx
@@ -16,7 +16,9 @@ export const AutoSignIn = () => {
     const handleSignIn = async (event: MessageEvent) => {
       if (event.data.type !== 'AUTO_SIGN_IN') return;
 
-      if (event.origin !== process.env.REACT_APP_DEPLOY_APP_URL) {
+      const allowedUrls = process.env.REACT_APP_ALLOWED_URLS?.split(',').map(url => url.trim());
+
+      if (!allowedUrls?.includes(event.origin)) {
         console.log('Unauthorized app.');
         return;
       }
diff --git a/stack/stack-orchestrator/config/app/run.sh b/stack/stack-orchestrator/config/app/run.sh
index 5cdfcfa..41fcb32 100755
--- a/stack/stack-orchestrator/config/app/run.sh
+++ b/stack/stack-orchestrator/config/app/run.sh
@@ -17,7 +17,7 @@ REACT_APP_WALLET_CONNECT_PROJECT_ID=$WALLET_CONNECT_ID \
 REACT_APP_DEFAULT_GAS_PRICE=$CERC_DEFAULT_GAS_PRICE \
 REACT_APP_GAS_ADJUSTMENT=$CERC_GAS_ADJUSTMENT \
 REACT_APP_LACONICD_RPC_URL=$CERC_LACONICD_RPC_URL \
-REACT_APP_DEPLOY_APP_URL=$CERC_DEPLOY_APP_URL \
+REACT_APP_ALLOWED_URLS=$CERC_ALLOWED_URLS \
 yarn build
 
 # Define the directory and file path