<?php

return [

    /*
    |--------------------------------------------------------------------------
    | Cross-Origin Resource Sharing (CORS) Configuration
    |--------------------------------------------------------------------------
    |
    | Here you may configure your settings for cross-origin resource sharing
    | or "CORS". This determines what cross-origin operations may execute
    | in web browsers. You are free to adjust these settings as needed.
    |
    | To learn more: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
    |
    */

    'paths' => ['api', 'api/*', 'sanctum/csrf-cookie'],

    'allowed_methods' => ['*'],

    'allowed_origins' => array_values(array_filter(array_unique(array_merge(
        [
            'https://pandamarts.co.uk',
            'http://pandamarts.co.uk',
            'https://www.pandamarts.co.uk',
            'http://www.pandamarts.co.uk',
            'https://demo.pandamarts.co.uk',
            'http://demo.pandamarts.co.uk',
            'http://localhost:5173',
            'http://127.0.0.1:5173',
            'http://localhost:3000',
            'http://127.0.0.1:3000',
            'http://localhost:8000',
            'http://127.0.0.1:8000',
            'http://localhost:8001',
            'http://127.0.0.1:8001',
        ],
        array_filter(array_map('trim', explode(',', (string) env('CORS_ALLOWED_ORIGINS', '')))),
        env('FRONTEND_URL') ? [rtrim((string) env('FRONTEND_URL'), '/')] : []
    )))),

    'allowed_origins_patterns' => [],

    'allowed_headers' => [
        'Content-Type',
        'Authorization',
        'X-Requested-With',
        'Accept',
        'Origin',
        'X-XSRF-TOKEN',
        'X-Branch-Id',
    ],

    'exposed_headers' => ['Authorization', 'X-XSRF-TOKEN'],

    'max_age' => 86400,

    'supports_credentials' => true,

];
