// SPDX-License-Identifier: MIT
// Copyright (c) 2024-2026 Acme Corp.
const ALLOWED = (process.env.CORS_ORIGINS ?? "https://demo.acme.example").split(",");
function corsMiddleware(req, res, next) {
const origin = req.headers.origin;
if (origin && ALLOWED.includes(origin)) {
res.setHeader("Access-Control-Allow-Origin", origin);
res.setHeader("Vary", "Origin");
}
if (req.method === "OPTIONS") return res.status(204).end();
next();
}
module.exports = { corsMiddleware };