<?php

return [

    /*
    |--------------------------------------------------------------------------
    | Cross-Origin Resource Sharing (CORS) Configuration
    |--------------------------------------------------------------------------
    */

    'paths' => ['api/*', 'sanctum/csrf-cookie'],

    'allowed_methods' => ['*'],

    // Tambahkan origin frontend production lewat env CORS_ALLOWED_ORIGINS
    // (pisahkan dengan koma jika lebih dari satu), tanpa perlu ubah kode ini
    // saat domain berubah. Contoh: CORS_ALLOWED_ORIGINS=https://gembira.eisvibe.com
    'allowed_origins' => array_values(array_filter(array_merge(
        [
            'http://localhost',
            'http://localhost:5173',  // Vite dev server
            'http://localhost:5174',  // Vite dev alt port
            'http://localhost:5175',  // Vite dev alt port 2
            'http://localhost:3000',  // Alternative
            'http://127.0.0.1:5173',
            'http://127.0.0.1:5175',
            'https://gembira.eisvibe.com',
        ],
        array_map('trim', explode(',', (string) env('CORS_ALLOWED_ORIGINS', '')))
    ))),

    'allowed_origins_patterns' => [],

    'allowed_headers' => ['*'],

    'exposed_headers' => [],

    'max_age' => 0,

    'supports_credentials' => true,

];
