patch CSRF and CI

backend/core/settings/base.py

@@ -115,7 +115,6 @@ CORS_ALLOW_CREDENTIALS = True
 REST_FRAMEWORK = {
     'DEFAULT_AUTHENTICATION_CLASSES': (
         'rest_framework_simplejwt.authentication.JWTAuthentication',
-        'rest_framework.authentication.SessionAuthentication',
     ),
     'DEFAULT_PERMISSION_CLASSES': (
         'rest_framework.permissions.IsAuthenticated',

backend/core/settings/development.py

@@ -4,6 +4,18 @@ DEBUG = True
 # ALLOWED_HOSTS = ['localhost', '127.0.0.1', 'backend']
 ALLOWED_HOSTS = ['*']
 
+# CSRF trusted origins (env + poznate domene)
+CSRF_TRUSTED_ORIGINS = [
+    origin.strip()
+    for origin in os.environ.get('CSRF_TRUSTED_ORIGINS', '').split(',')
+    if origin.strip()
+] + [
+    'https://api-004.captain.mitteworkspace.cloud',
+    'https://serviseri-004.captain.mitteworkspace.cloud',
+    'http://localhost:4321',
+    'http://127.0.0.1:4321',
+]
+
 # SQLite za brzi lokalni razvoj (nema potrebe za instalacijom Postgresa na laptopu)
 # DATABASES = {
 #     'default': {

backend/core/settings/production.py

@@ -23,6 +23,16 @@ CSRF_COOKIE_SECURE = True
 # Produkcijski CORS (samo domena na kojoj vrti Astro)
 CORS_ALLOWED_ORIGINS = os.environ.get('CORS_ALLOWED_ORIGINS', '').split(',')
 
+# csrf trusted origins za produkciju (env + poznate domene)
+CSRF_TRUSTED_ORIGINS = [
+    origin.strip()
+    for origin in os.environ.get('CSRF_TRUSTED_ORIGINS', '').split(',')
+    if origin.strip()
+] + [
+    'https://api-004.captain.mitteworkspace.cloud',
+    'https://serviseri-004.captain.mitteworkspace.cloud',
+]
+
 # Statika i Mediji
 STATIC_ROOT = '/app/staticfiles'
 MEDIA_ROOT = '/app/media'