// SPDX-License-Identifier: MIT
// Copyright (c) 2024-2026 Acme Corp.

const ALLOWED = (process.env.CORS_ORIGINS ?? "https://demo.acme.example").split(",");

function corsMiddleware(req, res, next) {
    const origin = req.headers.origin;
    if (origin && ALLOWED.includes(origin)) {
        res.setHeader("Access-Control-Allow-Origin", origin);
        res.setHeader("Vary", "Origin");
    }
    if (req.method === "OPTIONS") return res.status(204).end();
    next();
}

module.exports = { corsMiddleware };
