From ea4e787d1cd545b6cb9de5b60c76f9e6b71c3070 Mon Sep 17 00:00:00 2001
From: dsutanto <dedy.sutanto@saltis.id>
Date: Mon, 20 Jul 2026 12:22:27 +0700
Subject: [PATCH] Fix Backend site-uuid filter

---
 backend/routes/dashboard/helpers.js | 2 +-
 backend/server.js                   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/routes/dashboard/helpers.js b/backend/routes/dashboard/helpers.js
index 41d994c..d7b0429 100644
--- a/backend/routes/dashboard/helpers.js
+++ b/backend/routes/dashboard/helpers.js
@@ -40,7 +40,7 @@ function getBaseFilter(req, timeFilter = null) {
   
   if (isGlobalUser && requestedSiteUuid) {
     filter.site_uuid = requestedSiteUuid;
-  } else if (req.user?.site_uuid) {
+  } else if (!isGlobalUser && req.user?.site_uuid) {
     filter.site_uuid = req.user.site_uuid;
   }
 
diff --git a/backend/server.js b/backend/server.js
index 9cf0488..ea8f94f 100644
--- a/backend/server.js
+++ b/backend/server.js
@@ -43,7 +43,7 @@ const ALLOWED_ORIGINS = process.env.ALLOWED_ORIGINS
 app.use(cors({
   origin: (origin, callback) => {
     if (!origin) return callback(null, true);
-    if (ALLOWED_ORIGINS.includes(origin)) {
+    if (ALLOWED_ORIGINS.includes('*') || ALLOWED_ORIGINS.includes(origin)) {
       callback(null, true);
     } else {
       callback(new Error('Blocked by CORS policy (Unauthorized Origin)'));