<?php

return [
    /*
    | Cross-Origin Resource Sharing for the Verde API.
    |
    | Same-origin requests (admin web on waste.test) don't need CORS at all.
    | Customer-facing Next.js site lives at CUSTOMER_APP_URL — likely a
    | different domain (app.verde.ph). It needs CORS + credentials so
    | the Next.js auth-proxy route handlers can attach the cookie.
    */

    'paths' => ['api/*', 'sanctum/csrf-cookie', 'broadcasting/auth'],

    'allowed_methods' => ['*'],

    'allowed_origins' => array_filter(array_merge(
        [env('CUSTOMER_APP_URL')],
        explode(',', (string) env('EXTRA_CORS_ORIGINS', '')),
    )),

    'allowed_origins_patterns' => [
        '#^http://localhost:\d+$#',
        '#^http://127\.0\.0\.1:\d+$#',
    ],

    'allowed_headers' => ['*'],

    'exposed_headers' => [],

    'max_age' => 0,

    'supports_credentials' => true,
];