Fix CORS and improved error handling for HF deployment

backend/src/server.js

@@ -23,13 +23,29 @@ const allowedOrigins = [
 
 app.use(cors({
   origin: (origin, cb) => {
-    // Allow requests with no origin (nginx proxy, curl, etc.)
-    if (!origin || allowedOrigins.includes(origin)) return cb(null, true);
-    cb(new Error('CORS blocked'));
+    // Allow requests with no origin (like mobile apps or curl)
+    if (!origin) return cb(null, true);
+    
+    // Allow Hugging Face domains or locally allowed origins
+    if (origin.endsWith('.hf.space') || origin.includes('huggingface.co') || allowedOrigins.includes(origin)) {
+      return cb(null, true);
+    }
+    
+    // In production, be a bit more flexible if we're on HF
+    if (process.env.NODE_ENV === 'production' && origin.includes('hf.space')) {
+      return cb(null, true);
+    }
+
+    // Allow all in development for easier debugging
+    if (process.env.NODE_ENV !== 'production') {
+      return cb(null, true);
+    }
+
+    cb(new Error(`CORS blocked for origin: ${origin}`));
   },
   credentials: true,
-  methods: ['GET','POST','PATCH','PUT','DELETE','OPTIONS'],
-  allowedHeaders: ['Content-Type','Authorization'],
+  methods: ['GET', 'POST', 'PATCH', 'PUT', 'DELETE', 'OPTIONS'],
+  allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With'],
 }));
 
 const generalLimiter = rateLimit({ windowMs: 15*60*1000, max: 500, standardHeaders: true, legacyHeaders: false });
@@ -49,14 +65,25 @@ app.use('/api/tasks/:id/comments', commentRoutes);
 app.use('/api/admin',              adminRoutes);
 
 app.use((req, res) => res.status(404).json({ error: 'Endpoint not found.' }));
+
+// Global error handler
 app.use((err, req, res, next) => {
-  console.error('Unhandled error:', err.message);
+  console.error('[Global Error Manager]:', err.message || err);
+  
+  // Specific handling for CORS errors to make them more helpful
+  if (err.message && err.message.includes('CORS')) {
+    return res.status(403).json({ 
+      error: 'Security block: origin not allowed.', 
+      details: process.env.NODE_ENV === 'production' ? undefined : err.message 
+    });
+  }
+
   res.status(500).json({ error: 'An unexpected error occurred.' });
 });
 
 const PORT = process.env.PORT || 5000;
 app.listen(PORT, '127.0.0.1', () =>
-  console.log(`Taskflow API on port ${PORT} [${process.env.NODE_ENV || 'development'}]`)
+  console.log(`Taskflow API on port ${PORT} [${process.env.NODE_ENV || 'production'}]`)
 );
 
 module.exports = app;

frontend/src/pages/AcceptInvitePage.jsx

@@ -61,7 +61,7 @@ export default function AcceptInvitePage() {
                 type={showPw?'text':'password'} placeholder="Min 8 characters"
                 value={form.password} onChange={e=>setForm(f=>({...f,password:e.target.value}))}/>
               <button type="button" className={styles.pwToggle} onClick={()=>setShowPw(v=>!v)}>
-                {showPw?<Eye size={15}/>:<Eye size={15}/>}
+                {showPw?<EyeOff size={15}/>:<Eye size={15}/>}
               </button>
             </div>
             {errors.password && <span className="field-error">{errors.password}</span>}