Security: Restrict API endpoints to allowed origin (CORS)

Both Vercel serverless functions now enforce CORS, returning 403 for
requests from any origin other than craze-data-check.vercel.app.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/dropbox-sync.js

@@ -2,25 +2,47 @@ import { createClient } from '@supabase/supabase-js';
 
 const SUPABASE_URL = process.env.SUPABASE_URL || 'https://hwithddwaapyhnfwcesj.supabase.co';
 const SUPABASE_KEY = process.env.SUPABASE_SERVICE_KEY || 'sb_publishable_fGXkh0bSrAOqSk2jWKAzSg_NJD9YPCv';
+const ALLOWED_ORIGIN = 'https://craze-data-check.vercel.app';
 
 const supabase = createClient(SUPABASE_URL, SUPABASE_KEY);
 
+function setCors(req, res) {
+  const origin = req.headers.origin;
+  if (origin === ALLOWED_ORIGIN) {
+    res.setHeader('Access-Control-Allow-Origin', ALLOWED_ORIGIN);
+  }
+  res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+  res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+  res.setHeader('Vary', 'Origin');
+}
+
 export default async function handler(req, res) {
+  setCors(req, res);
+
+  if (req.method === 'OPTIONS') {
+    return res.status(204).end();
+  }
+
+  const origin = req.headers.origin;
+  if (origin && origin !== ALLOWED_ORIGIN) {
+    return res.status(403).json({ error: 'Forbidden' });
+  }
+
   try {
     if (req.method !== 'POST') {
       return res.status(405).json({ error: 'Method not allowed' });
     }
 
-    const { rows, fileMeta } = req.body;
-    
+    const { rows } = req.body;
+
     if (!rows || !Array.isArray(rows)) {
       return res.status(400).json({ error: 'Missing rows data' });
     }
 
     const articleNoIdx = 0;
-    
+
     const productsToUpsert = [];
-    
+
     for (const row of rows) {
       const productId = String(row[articleNoIdx]);
       if (productId && productId.trim() !== '') {
@@ -37,9 +59,9 @@ export default async function handler(req, res) {
 
     const { error } = await supabase
       .from('products')
-      .upsert(productsToUpsert, { 
+      .upsert(productsToUpsert, {
         onConflict: 'product_id',
-        ignoreDuplicates: true 
+        ignoreDuplicates: true
       });
 
     if (error) {
@@ -47,12 +69,12 @@ export default async function handler(req, res) {
       return res.status(500).json({ error: error.message, detail: 'Failed to upsert products' });
     }
 
-    return res.json({ 
-      success: true, 
-      syncedCount: productsToUpsert.length 
+    return res.json({
+      success: true,
+      syncedCount: productsToUpsert.length
     });
   } catch (err) {
     console.error('Handler error:', err);
     res.status(500).json({ error: err.message });
   }
-}
+}