From 41e0501e6b300cfd81c9e82cb73216282a67d731 Mon Sep 17 00:00:00 2001
From: MythEclipse <asepharyanalm001@gmail.com>
Date: Mon, 15 Jun 2026 14:32:54 +0700
Subject: [PATCH] fix(tauri): add absolute API base URL default and CORS
 origins for Android WebView

- Set VITE_API_BASE_URL default to production API URL in api-client.ts
  so fetch() uses absolute URLs instead of relative paths that fail on Tauri
- Add tauri://localhost and https://tauri.localhost to API CORS allowed origins
- Also fix .env WEB_APP_URL from stale .tech to .my.id

Co-Authored-By: Claude <noreply@anthropic.com>
---
 apps/api/src/config/env.ts     | 7 +++++++
 apps/api/src/index.ts          | 2 +-
 apps/web/src/lib/api-client.ts | 2 +-
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/apps/api/src/config/env.ts b/apps/api/src/config/env.ts
index 4d55f1b..0a36135 100644
--- a/apps/api/src/config/env.ts
+++ b/apps/api/src/config/env.ts
@@ -8,6 +8,12 @@ const googleOAuthEnabled = Boolean(
 );
 
 const webAppUrl = Bun.env.WEB_APP_URL ?? 'http://localhost:5173';
+const allowedOrigins = [
+  webAppUrl,
+  'https://tauri.localhost',
+  'tauri://localhost',
+  'http://localhost:5173',
+];
 const secureCookies = Bun.env.SECURE_COOKIES === 'true' || webAppUrl.startsWith('https://');
 
 export const env = {
@@ -24,6 +30,7 @@ export const env = {
   googleClientSecret: Bun.env.GOOGLE_CLIENT_SECRET,
   googleRedirectUri: Bun.env.GOOGLE_REDIRECT_URI,
   webAppUrl,
+  allowedOrigins,
   secureCookies,
 };
 
diff --git a/apps/api/src/index.ts b/apps/api/src/index.ts
index 91d11be..a292675 100644
--- a/apps/api/src/index.ts
+++ b/apps/api/src/index.ts
@@ -17,7 +17,7 @@ assertRequiredEnv();
 
 const app = new Elysia()
   .use(cors({
-    origin: env.webAppUrl,
+    origin: env.allowedOrigins,
     credentials: true,
   }))
   .use(metricsRoutes)
diff --git a/apps/web/src/lib/api-client.ts b/apps/web/src/lib/api-client.ts
index fa1b7fa..4c5d0b9 100644
--- a/apps/web/src/lib/api-client.ts
+++ b/apps/web/src/lib/api-client.ts
@@ -14,7 +14,7 @@ import type {
 } from '@zeavis/shared';
 import { recordApiCall } from './telemetry';
 
-const apiBaseUrl = import.meta.env.VITE_API_BASE_URL ?? '';
+const apiBaseUrl = import.meta.env.VITE_API_BASE_URL ?? 'https://zeavisedu.asepharyana.my.id';
 
 export interface ApiError extends Error {
   status: number;