security: sync CORS and error handling security updates in main repo

server/server.js

@@ -55,7 +55,7 @@ if (process.env.ALLOWED_ORIGINS) {
 
 app.use(cors({
   origin: function (origin, callback) {
-    if (!origin || allowedOrigins.indexOf(origin) !== -1 || origin.endsWith('.netlify.app') || origin.endsWith('.onrender.com')) {
+    if (!origin || allowedOrigins.indexOf(origin) !== -1) {
       callback(null, true);
     } else {
       callback(new Error('Not allowed by CORS'));
@@ -207,7 +207,8 @@ app.post('/api/log/voice', authenticateWorker, async (req, res) => {
     await logVoiceWords(words, timestamp);
     res.json({ success: true, count: words.length });
   } catch (err) {
-    res.status(500).json({ error: err.message });
+    console.error('[API Error] /api/log/voice:', err);
+    res.status(500).json({ error: 'Internal Server Error' });
   }
 });
 
@@ -218,7 +219,8 @@ app.post('/api/log/mod-action', authenticateWorker, async (req, res) => {
     await logModAction(action);
     res.json({ success: true });
   } catch (err) {
-    res.status(500).json({ error: err.message });
+    console.error('[API Error] /api/log/mod-action:', err);
+    res.status(500).json({ error: 'Internal Server Error' });
   }
 });
 
@@ -228,7 +230,8 @@ app.post('/api/log/stream-end', authenticateWorker, async (req, res) => {
     await endActiveStream();
     res.json({ success: true });
   } catch (err) {
-    res.status(500).json({ error: err.message });
+    console.error('[API Error] /api/log/stream-end:', err);
+    res.status(500).json({ error: 'Internal Server Error' });
   }
 });
 
@@ -238,7 +241,8 @@ app.get('/api/streams/pending-backfill', authenticateWorker, async (req, res) =>
     const streams = await getPendingBackfillStreams();
     res.json({ success: true, streams });
   } catch (err) {
-    res.status(500).json({ error: err.message });
+    console.error('[API Error] /api/streams/pending-backfill:', err);
+    res.status(500).json({ error: 'Internal Server Error' });
   }
 });
 
@@ -249,7 +253,8 @@ app.post('/api/streams/mark-backfilled', authenticateWorker, async (req, res) =>
     await markStreamBackfilled(streamId, twitchStreamId);
     res.json({ success: true });
   } catch (err) {
-    res.status(500).json({ error: err.message });
+    console.error('[API Error] /api/streams/mark-backfilled:', err);
+    res.status(500).json({ error: 'Internal Server Error' });
   }
 });
 
@@ -264,7 +269,8 @@ app.post('/api/streams/reset-backfill', requireModeratorRole, async (req, res) =
     cache.flush();
     res.json({ success: true });
   } catch (err) {
-    res.status(500).json({ error: err.message });
+    console.error('[API Error] /api/streams/reset-backfill:', err);
+    res.status(500).json({ error: 'Internal Server Error' });
   }
 });
 
@@ -279,7 +285,8 @@ app.delete('/api/streams/:id', requireAdminRole, async (req, res) => {
     cache.flush();
     res.json({ success: true });
   } catch (err) {
-    res.status(500).json({ error: err.message });
+    console.error('[API Error] /api/streams/:id (DELETE):', err);
+    res.status(500).json({ error: 'Internal Server Error' });
   }
 });
 
@@ -298,7 +305,8 @@ app.put('/api/streams/:id', requireAdminRole, async (req, res) => {
     cache.flush();
     res.json({ success: true });
   } catch (err) {
-    res.status(500).json({ error: err.message });
+    console.error('[API Error] /api/streams/:id (PUT):', err);
+    res.status(500).json({ error: 'Internal Server Error' });
   }
 });
 
@@ -309,7 +317,8 @@ app.post('/api/admin/cleanup', requireAdminRole, async (req, res) => {
     cache.flush();
     res.json({ success: true, count: deletedCount });
   } catch (err) {
-    res.status(500).json({ error: err.message });
+    console.error('[API Error] /api/admin/cleanup:', err);
+    res.status(500).json({ error: 'Internal Server Error' });
   }
 });
 
@@ -320,7 +329,8 @@ app.get('/api/admin/stats', requireAdminRole, async (req, res) => {
     const cacheStats = cache.getStats();
     res.json({ success: true, stats, cacheStats });
   } catch (err) {
-    res.status(500).json({ error: err.message });
+    console.error('[API Error] /api/admin/stats:', err);
+    res.status(500).json({ error: 'Internal Server Error' });
   }
 });
 
@@ -769,8 +779,8 @@ app.post('/api/streams/sync-vods', async (req, res) => {
 
     res.json({ success: true, count: syncedStreams.length, streams: syncedStreams });
   } catch (err) {
-    console.error('[Twitch API] Error syncing VODs:', err.message);
-    res.status(500).json({ error: err.message });
+    console.error('[Twitch API] Error syncing VODs:', err);
+    res.status(500).json({ error: 'Internal Server Error' });
   }
 });
 
@@ -786,7 +796,8 @@ app.post('/api/streams/sync-vod-direct', authenticateWorker, async (req, res) =>
     }
     res.status(500).json({ error: 'Failed to sync stream session' });
   } catch (err) {
-    res.status(500).json({ error: err.message });
+    console.error('[API Error] /api/streams/sync-vod-direct:', err);
+    res.status(500).json({ error: 'Internal Server Error' });
   }
 });