Add Dockerfile and fix CORS errors

Dockerfile

@@ -0,0 +1,12 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install -r requirements.txt
+
+COPY . .
+
+EXPOSE 8000
+
+CMD ["bash", "/app/start.sh"]

backup/app/main.py

@@ -2,6 +2,7 @@
 import shutil
 import logging
 from contextlib import asynccontextmanager
+from urllib.parse import urlsplit
 
 from dotenv import load_dotenv
 from fastapi import FastAPI
@@ -22,21 +23,47 @@
 logger = logging.getLogger(__name__)
 
 
+def _normalize_origin(origin: str) -> str | None:
+    """Normalize CORS entries to scheme://host[:port] and drop invalid values."""
+    raw = origin.strip()
+    if not raw:
+        return None
+
+    parsed = urlsplit(raw)
+    if not parsed.scheme or not parsed.netloc:
+        logger.warning("Ignoring invalid CORS origin '%s'", origin)
+        return None
+
+    normalized = f"{parsed.scheme}://{parsed.netloc}"
+    if normalized != raw.rstrip("/"):
+        logger.warning("Normalized CORS origin '%s' to '%s'", origin, normalized)
+    return normalized
+
+
+def _normalized_unique(origins: list[str]) -> list[str]:
+    result: list[str] = []
+    for origin in origins:
+        normalized = _normalize_origin(origin)
+        if normalized and normalized not in result:
+            result.append(normalized)
+    return result
+
+
 def _build_allowed_origins() -> list[str]:
     """Build a strict CORS allow-list from environment variables."""
     allowed_origins_env = os.getenv("FRONTEND_ALLOWED_ORIGINS", "")
-    parsed = [origin.strip() for origin in allowed_origins_env.split(",") if origin.strip()]
+    parsed = _normalized_unique(allowed_origins_env.split(","))
 
     if parsed:
         return parsed
 
     # Backward-compatible fallback when comma-separated variable is not set.
-    legacy_origins = [o for o in [FRONTEND_DEV_URL, FRONTEND_PROD_URL] if o]
+    legacy_origins = _normalized_unique([FRONTEND_DEV_URL, FRONTEND_PROD_URL])
     if legacy_origins:
         return legacy_origins
 
     # Safe local fallback for development/test only.
-    return ["http://localhost:3000", "http://127.0.0.1:3000", "*"]
+    return ["http://localhost:3000", "http://127.0.0.1:3000"]
 
 
 ALLOWED_ORIGINS = _build_allowed_origins()

pages/scoreboard.html

@@ -63,6 +63,7 @@ <h2>
     <p>Laboratory of Research in Computer Science and Applications (LRSIA), 2026</p>
 </footer>
 
+<script src="static/js/config.js"></script>
 <script src="static/js/scoreboard.js"></script>
 </body>
 </html>

pages/static/js/auth.js

@@ -1,4 +1,4 @@
-const API_URL  = "http://localhost:8000";
+const API_URL = window.APP_CONFIG?.API_URL || "https://mpvrppythonapi.pinite37.me";
 let   authMode = 'login';
 
 document.getElementById('mobile-menu').addEventListener('click', () => {

pages/static/js/config.js

@@ -0,0 +1,3 @@
+window.APP_CONFIG = Object.freeze({
+    API_URL: "https://mpvrppythonapi.pinite37.me"
+});

pages/static/js/scoreboard.js

@@ -1,5 +1,4 @@
-// load API_URL from .env file
-const API_URL = 'http://localhost:8000';
+const API_URL = window.APP_CONFIG?.API_URL || "https://mpvrppythonapi.pinite37.me";
 
 // ── Nav mobile ───────────────────────────────────────────
 document.getElementById('mobile-menu').addEventListener('click', () => {

pages/submission.html

@@ -22,7 +22,7 @@ <h1>
         </div>
         <ul class="nav-links" id="nav-links">
             <li><a href="../index.html">Home</a></li>
-            <li><a href="scoreboard.html">Leaderboard</a></li>
+            <li><a href="scoreboard.html">Scoreboard</a></li>
             <li><a href="submission.html" class="active">Submission</a></li>
             <li id="nav-team-name" style="display:none; color:#3C27F5; font-weight:bold; font-size:15px; padding: 0 5px;"></li>
             <li id="nav-logout-li" style="display:none;">
@@ -108,6 +108,7 @@ <h3 style="margin-top:30px;">Your history</h3>
 </footer>
 
 
+<script src="static/js/config.js"></script>
 <script src="static/js/auth.js"></script>
 </body>
 </html>

start.sh

@@ -12,11 +12,11 @@ WORKERS="${WORKERS:-2}"
 
 # Export DATABASE_URL (uses existing value if already set).
 export DATABASE_URL="${DATABASE_URL:-sqlite:///./mpvrp_scoring.db}"
+export FRONTEND_ALLOWED_ORIGINS="${FRONTEND_ALLOWED_ORIGINS:-https://ifri-ai-classes.github.io,https://ifri-ai-classes.github.io/MPVRP-CC,https://ifri-ai-classes.github.io/MPVRP-CC/pages}"
 
 # Require stable secret key in environments with external users.
 # Generate and export a fresh SECRET_KEY at launch time.
-SECRET_KEY="$(python -c "import secrets; print('SECRET_KEY=' + secrets.token_urlsafe(32))")"
-export "$SECRET_KEY"
+export SECRET_KEY="$(python -c "import secrets; print(secrets.token_urlsafe(32))")"
 if [[ -z "${SECRET_KEY:-}" ]]; then
   echo "ERROR: SECRET_KEY is required. Set it in your environment before starting the server." >&2
   exit 1