<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class HandleCors
{

    public function handle(Request $request, Closure $next): mixed
    {
        $response = $next($request);

        $origin = $request->header('origin');
        $allowedOrigins = config('cors.origins');

        if (!app()->environment('production')) {
            $allowOrigin = '*';
        } else {
            $allowOrigin = in_array($origin, $allowedOrigins, true) ? $origin : 'https://group.quadcode.com';
        }

        $response->header('Access-Control-Allow-Origin', $allowOrigin)
            ->header('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS')
            ->header('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With');

        return $response;
    }
}