<?php

/**
 * Bdzoon CORS Configuration
 * Supports: local dev, staging, production, and Bdzoon domains
 */

$allowedOrigins = array_filter(array_unique([
    // Local development
    'http://localhost',
    'http://localhost:3000',
    'http://localhost:5173',
    'http://localhost:8080',
    'http://127.0.0.1',
    'http://127.0.0.1:5173',
    'http://127.0.0.1:3000',

    // Production domains (from .env)
    env('FRONTEND_URL'),
    env('FRONTEND_URL_WWW'),
    env('APP_URL'),

    // Bdzoon production domains
    'https://bdzoon.com',
    'https://www.bdzoon.com',
    'https://api.bdzoon.com',
    'https://admin.bdzoon.com',
    'https://shop.bdzoon.com',

    // Staging
    env('STAGING_URL'),
]));

return [
    // Apply to all API routes + Sanctum CSRF
    'paths' => ['api/*', 'sanctum/csrf-cookie', 'api/v1/*'],

    'allowed_methods' => ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],

    // Exact domain matches
    'allowed_origins' => array_values($allowedOrigins),

    // Wildcard pattern matches (subdomains of bdzoon.com)
    'allowed_origins_patterns' => [
        '#^https?://(.+\.)?bdzoon\.com$#',
        '#^https?://localhost(:\d+)?$#',
        '#^https?://127\.0\.0\.1(:\d+)?$#',
    ],

    'allowed_headers' => [
        'Content-Type',
        'Accept',
        'Authorization',
        'X-Requested-With',
        'X-CSRF-TOKEN',
        'X-XSRF-TOKEN',
        'Origin',
        'Cache-Control',
    ],

    // Headers browser can read
    'exposed_headers' => [
        'X-RateLimit-Limit',
        'X-RateLimit-Remaining',
        'Retry-After',
    ],

    // Cache preflight for 2 hours
    'max_age' => 7200,

    // Required for Sanctum cookie-based auth
    'supports_credentials' => true,
];
