From 1014e438111222c1f8d9ecb8627960c5873035f9 Mon Sep 17 00:00:00 2001
From: igorbeslic <igor.beslic@bitnaprednost.hr>
Date: Fri, 25 Jul 2025 12:26:41 +0200
Subject: [PATCH 1/4] CORS - web configurer dependency

---
 server/ee/libs/config/cloud-config/build.gradle.kts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server/ee/libs/config/cloud-config/build.gradle.kts b/server/ee/libs/config/cloud-config/build.gradle.kts
index 5c364f1b5b..9e39c0158c 100644
--- a/server/ee/libs/config/cloud-config/build.gradle.kts
+++ b/server/ee/libs/config/cloud-config/build.gradle.kts
@@ -1,4 +1,5 @@
 dependencies {
     implementation("org.springframework:spring-context")
     implementation("org.springframework:spring-web")
+    implementation("org.springframework:spring-webmvc")
 }

From 6b9aba13001ecfecb555a0097d6231daa95fcaaa Mon Sep 17 00:00:00 2001
From: igorbeslic <igor.beslic@bitnaprednost.hr>
Date: Fri, 25 Jul 2025 12:26:55 +0200
Subject: [PATCH 2/4] CORS - annotation doesn't cover all controller paths, add
 web configurer and setup CORS (allow all)

---
 .../config/CloudCrossOriginConfiguration.java | 20 ++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/server/ee/libs/config/cloud-config/src/main/java/com/bytechef/ee/cloud/config/CloudCrossOriginConfiguration.java b/server/ee/libs/config/cloud-config/src/main/java/com/bytechef/ee/cloud/config/CloudCrossOriginConfiguration.java
index f7309e1eff..b9e1a1493c 100644
--- a/server/ee/libs/config/cloud-config/src/main/java/com/bytechef/ee/cloud/config/CloudCrossOriginConfiguration.java
+++ b/server/ee/libs/config/cloud-config/src/main/java/com/bytechef/ee/cloud/config/CloudCrossOriginConfiguration.java
@@ -18,7 +18,8 @@
 
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Profile;
-import org.springframework.web.bind.annotation.CrossOrigin;
+import org.springframework.web.servlet.config.annotation.CorsRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 
 /**
  * Configuration class that sets up cross-origin resource sharing (CORS) for the application.
@@ -41,9 +42,18 @@
  * @author Ivica Cardic
  */
 @Configuration
-@CrossOrigin(origins = {
-    "https://app.bytechef.io", "https://test.app.bytechef.io"
-})
 @Profile("cloud")
-public class CloudCrossOriginConfiguration {
+public class CloudCrossOriginConfiguration implements WebMvcConfigurer {
+
+    @Override
+    public void addCorsMappings(CorsRegistry registry) {
+        registry
+            .addMapping("/**")
+            .allowedOrigins("https://app.bytechef.io", "https://test.app.bytechef.io", "http://app.igor.io")
+            //.allowedHeaders("Content-Type", "Authorization", "Access-Control-Request-Headers", "X-Xsrf-Token")//"Access-Control-Request-Headers"
+            .allowedHeaders("*")
+            .allowedMethods("*")
+            .allowCredentials(Boolean.TRUE);
+    }
+
 }

From 9a9571e7f38e09f95828c3de950458e42fc4575d Mon Sep 17 00:00:00 2001
From: igorbeslic <igor.beslic@bitnaprednost.hr>
Date: Fri, 25 Jul 2025 12:27:06 +0200
Subject: [PATCH 3/4] CORS - ignore csrf token for requests with http
 method=OPTIONS

---
 .../bytechef/security/config/SecurityConfiguration.java  | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/server/libs/config/security-config/src/main/java/com/bytechef/security/config/SecurityConfiguration.java b/server/libs/config/security-config/src/main/java/com/bytechef/security/config/SecurityConfiguration.java
index 839224fbfc..93b507c55a 100644
--- a/server/libs/config/security-config/src/main/java/com/bytechef/security/config/SecurityConfiguration.java
+++ b/server/libs/config/security-config/src/main/java/com/bytechef/security/config/SecurityConfiguration.java
@@ -37,6 +37,7 @@
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Profile;
 import org.springframework.core.annotation.Order;
+import org.springframework.http.HttpMethod;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.AuthenticationProvider;
@@ -158,7 +159,8 @@ public SecurityFilterChain apiFilterChain(
                 .ignoringRequestMatchers("/sse")
                 .ignoringRequestMatchers(regexMatcher("^/(automation|embedded)/sse"))
                 // For internal calls from the embedded workflow builder
-                .ignoringRequestMatchers(request -> request.getHeader("Authorization") != null));
+                .ignoringRequestMatchers(request -> request.getHeader("Authorization") != null)
+                .ignoringRequestMatchers(request -> request.getMethod().equalsIgnoreCase(HttpMethod.OPTIONS.name())));
 
         for (AuthenticationProviderContributor authenticationProviderContributor : authenticationProviderContributors) {
             http.authenticationProvider(authenticationProviderContributor.getAuthenticationProvider());
@@ -198,7 +200,10 @@ public SecurityFilterChain apiFilterChain(
                 .requestMatchers(mvc.matcher("/sse"))
                 .permitAll()
                 .requestMatchers(mvc.matcher("/*/sse"))
-                .permitAll())
+                .permitAll()
+                .requestMatchers(mvc.matcher(HttpMethod.OPTIONS, "/**"))
+                .permitAll()
+            )
             .rememberMe(rememberMe -> rememberMe
                 .rememberMeServices(rememberMeServices)
                 .rememberMeParameter("remember-me")

From ffcd3a85da518e15c23405cc7b2d5b9e895da839 Mon Sep 17 00:00:00 2001
From: igorbeslic <igor.beslic@bitnaprednost.hr>
Date: Thu, 17 Jul 2025 17:14:50 +0200
Subject: [PATCH 4/4] STABLE - this commit is always on the top

---
 .../build_stable_publish_dockr_push.yml       | 75 +++++++++++++++++++
 1 file changed, 75 insertions(+)
 create mode 100644 .github/workflows/build_stable_publish_dockr_push.yml

diff --git a/.github/workflows/build_stable_publish_dockr_push.yml b/.github/workflows/build_stable_publish_dockr_push.yml
new file mode 100644
index 0000000000..fdf4621823
--- /dev/null
+++ b/.github/workflows/build_stable_publish_dockr_push.yml
@@ -0,0 +1,75 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+# This workflow will build a Java project with Gradle and cache/restore any dependencies to improve the workflow execution time
+# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-gradle
+
+name: CI Build on Stable Branch and Push to Cloud Repository
+
+on:
+  push:
+    branches: [ "stable" ]
+
+permissions:
+  contents: write
+
+jobs:
+  pushToCloudRepository:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout external repo
+      uses: actions/checkout@v4
+      with:
+        repository: bytechefhq/bytechef-cloud
+        token: ${{ secrets.PRIVATE_REPOSITORY_GIT_API_TOKEN }}  # PAT with 'repo' scope
+        path: bytechef-merge
+    - name: Investigate private repository checkout results
+      env:
+        ENV_BRANCH_NAME: stable-env-branch-name
+      run: |
+        pwd
+        ls -la bytechef-merge
+        cd bytechef-merge
+        git branch
+        git remote show
+        git remote rename origin origin-cloud
+        echo "Remote renamed"
+        git remote show
+        git remote add origin-public git@github.com:bytechefhq/bytechef.git
+        echo "New Remote Added"
+        git remote show
+        echo "Setup authorization"
+        /usr/bin/git config --local --name-only --get-regexp core\.sshCommand
+        echo "Setup authorization - STEP 1"
+        /usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
+        echo "Setup authorization - STEP 2"
+        /usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
+        echo "Setup authorization - STEP 3"
+        /usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
+        echo "Setup authorization - STEP 4"
+        /usr/bin/git config --local http.https://github.com/.extraheader AUTHORIZATION: basic ${{ secrets.PRIVATE_REPOSITORY_GIT_API_TOKEN }}
+        echo "Fetch public ${ENV_BRANCH_NAME}"
+        git fetch origin-public stable
+        git checkout -b stable-public origin-public/stable
+        echo "New Branch Added"
+        git branch
+        git remote show
+    - name: Remove last commit
+      run: |
+        pwd
+        cd bytechef-merge
+        ls -la
+        git remote show
+        git reset --hard HEAD~1
+        git remote show
+        echo "Done with git preparation"
+    - name: Push to private repository
+      run: |
+        pwd
+        ls -la
+        cd bytechef-merge
+        git remote show
+        git push -f origin-cloud stable-public:stable
+
