fix(controller): correctly rejected join channel if not on dev server for building

controller/main.go

@@ -4,19 +4,33 @@ import (
 	"fmt"
 	"log"
 	"net/http"
+	"os"
 	"time"
 
+	"github.com/gin-gonic/gin"
 	socketio "github.com/googollee/go-socket.io"
 	"github.com/joho/godotenv"
+	router "lst.net/internal/route_handler"
 )
 
 func main() {
 	err := godotenv.Load("../.env")
 	if err != nil {
-		//log := logger.New()
-		//log.Info("Warning: .env file not found (ok in Docker/production)", "system", map[string]interface{}{})
 		fmt.Println("Warning: .env file not found")
 	}
+
+	port := os.Getenv("PORT")
+	if port == "" {
+		port = "8080"
+	}
+
+	// gin stuff
+	basePath := "/api/controller"
+	if os.Getenv("NODE_ENV") != "production" {
+		basePath = "/lst/api/controller"
+	}
+	r := router.Setup(basePath) // returns *gin.Engine
+
 	server := socketio.NewServer(nil)
 
 	server.OnConnect("/", func(s socketio.Conn) error {
@@ -91,12 +105,16 @@ func main() {
 	go server.Serve()
 	defer server.Close()
 
-	// Enable CORS wrapper for Socket.IO route
-	http.Handle("/socket.io/", withCORS(server))
-	http.Handle("/", http.FileServer(http.Dir("./static")))
+	// mount socket.io on /socket.io/*
+	r.Any("/socket.io/*any", gin.WrapH(withCORS(server)))
 
-	fmt.Println("🚀 Socket.IO server running on :8000")
-	log.Fatal(http.ListenAndServe(":8000", nil))
+	// mount a static dir (like http.FileServer)
+	//r.Static("/", "./static")
+
+	fmt.Println("🚀 Server running on :" + port)
+	if err := r.Run(":" + port); err != nil {
+		log.Fatal("Server failed:", err)
+	}
 }
 
 // Reuse your proper CORS handler
@@ -104,12 +122,15 @@ func withCORS(h http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		origin := r.Header.Get("Origin")
 		if origin != "" {
+			// 🔑 Echo the request Origin, not "*"
 			w.Header().Set("Access-Control-Allow-Origin", origin)
 			w.Header().Set("Vary", "Origin")
 		}
+
 		w.Header().Set("Access-Control-Allow-Methods", "GET,POST,OPTIONS")
 		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
 		w.Header().Set("Access-Control-Allow-Credentials", "true")
+
 		if r.Method == http.MethodOptions {
 			w.WriteHeader(http.StatusNoContent)
 			return