From 2c3330f81a29722586858dc3a717b3de492eb8cd Mon Sep 17 00:00:00 2001
From: Yggdrasil <yggdrasilworld@users.noreply.github.com>
Date: Wed, 14 Oct 2026 02:23:21 -0400
Subject: [PATCH] fix(config): FRONTEND_URL/port defaults match where the
 frontend serves
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

next dev runs on 3000 — FRONTEND_URL defaulted to 3001 so CORS rejected the
frontend's origin and OAuth redirected to the wrong port. And the backend's
own PORT=3000 collided with the frontend's.

Now: backend PORT/APP_URL=3001, FRONTEND_URL=3000.

Resolves #590
---
 .env.example                |  6 +++---
 src/config/configuration.ts | 13 ++++++++++---
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/.env.example b/.env.example
index 7913f204..0b4321b5 100644
--- a/.env.example
+++ b/.env.example
@@ -10,11 +10,11 @@
 
 # --- App ---------------------------------------------------------------
 NODE_ENV=development
-PORT=3000
+PORT=3001
 # Public URL of this API, used to build OAuth callback / webhook URLs
-APP_URL=http://localhost:3000
+APP_URL=http://localhost:3001
 # Frontend URL, used for CORS + OAuth redirect back to the SPA
-FRONTEND_URL=http://localhost:3001
+FRONTEND_URL=http://localhost:3000
 
 # --- Database (PostgreSQL via TypeORM) ----------------------------------
 DATABASE_URL=postgresql://postgres:postgres@localhost:5432/mergefi
diff --git a/src/config/configuration.ts b/src/config/configuration.ts
index 40e91db2..d6400031 100644
--- a/src/config/configuration.ts
+++ b/src/config/configuration.ts
@@ -69,9 +69,16 @@ export interface AppConfig {
 
 export default (): AppConfig => ({
   env: process.env.NODE_ENV ?? 'development',
-  port: parseInt(process.env.PORT ?? '3000', 10),
-  appUrl: process.env.APP_URL ?? 'http://localhost:3000',
-  frontendUrl: process.env.FRONTEND_URL ?? 'http://localhost:3001',
+  // The frontend's `next dev` occupies 3000 — the backend's default is 3001
+  // so a fresh dev setup doesn't port-collide (#590).
+  port: parseInt(process.env.PORT ?? '3001', 10),
+  // FRONTEND_URL is the CORS origin + OAuth redirect target — it must match
+  // where the frontend actually serves. `next dev` runs on 3000, so the old
+  // 3001 default made CORS reject the frontend's origin and OAuth redirect
+  // wrong (#590). And the backend's own default PORT must differ from the
+  // frontend's 3000 — moved to 3001 so dev defaults don't collide.
+  appUrl: process.env.APP_URL ?? 'http://localhost:3001',
+  frontendUrl: process.env.FRONTEND_URL ?? 'http://localhost:3000',
   logLevel: process.env.LOG_LEVEL ?? 'debug',
   database: {
     url: