# Finance dashboard Tailnet handoff CORS

Use when FinanceManager is exposed through a JARVIS/operator Tailnet handoff and the browser UI opens but shows no data.

## Symptom

- Finance frontend returns `200 OK`.
- Finance API health/runtime endpoints return `200 OK` and the runtime DB is available.
- Safe API probes show non-empty response shape/counts.
- Browser-facing UI still appears empty or degraded.

Likely cause: backend CORS allowlist does not include the actual Tailnet frontend origin, especially when the handoff script selected a dynamic fallback port because the preferred port was occupied.

## Safe diagnosis

Never dump raw Finance API responses in chat. Instead summarize:

- `db_available`, `runtime_outside_repo`;
- top-level keys and key counts;
- list lengths;
- KPI key names and presence/absence of expected counters;
- redacted URLs/paths and no exact amounts/account IDs/transactions.

First verify the **correct frontend family** before debugging data: the modern FinanceManager user UI is the Vue/PrimeVue dashboard backed by FastAPI + SQLite, not the old Streamlit dashboard. If the user says the UI looks like an old stand, check active processes/ports and stop the Streamlit server before proceeding. Expected pattern in the current architecture:

- Vue dashboard: Vite on Tailnet/local frontend port (recently `5175`).
- FastAPI backend: internal `127.0.0.1:8010` with Vite `/api` proxy.
- Streamlit on `8503` is legacy/admin/fallback and should not be offered as the main Finance dashboard.

Then check CORS from the exact frontend origin:

```bash
curl -sS -m 5 -D - -o /dev/null \
  -H "Origin: http://<tailnet-ip>:<finance-frontend-port>" \
  http://<tailnet-ip>:<finance-api-port>/api/overview \
  | tr -d '\r' | grep -Ei 'HTTP/|access-control|vary|content-type'
```

If `access-control-allow-origin` is missing, fix CORS/runtime configuration rather than UI state.

## Fix pattern

- Finance API should support a runtime env var such as `JARVIS_FINANCE_CORS_ORIGINS`.
- The handoff script should set it to the generated Finance frontend URL plus any JARVIS shell URL that needs read-only access.
- Validate origins strictly: allow only `http://localhost:<port>`, `http://127.0.0.1:<port>`, Tailnet `http://100.x.x.x:<port>`, or approved `*.ts.net` hostnames.
- Add unit tests for origin parsing and rejecting arbitrary public/file origins.
- Add handoff smoke coverage for both API data shape and CORS header presence.

## Robustness recommendations

- Add `make handoff-status` to print URLs, PID health, API health, DB available, safe data shape, and CORS result.
- Extend Finance `/api/health` or add a safe readiness endpoint with no amounts: DB exists, migrations/table check, overview shape available, CORS/current origin check if origin is supplied.
- Finance frontend should distinguish “API not reachable”, “CORS blocked”, “DB missing”, “endpoint empty”, and “runtime misconfigured” instead of showing generic “no data”.