<?php

$origins = array_merge(
    [env('FRONTEND_URL')],
    explode(',', env('CORS_ALLOWED_ORIGINS', '')),
);
$origins = array_values(array_unique(array_filter(array_map(
    fn ($origin): string => is_string($origin) ? rtrim(trim($origin), '/') : '',
    $origins,
))));

return [
    'paths' => ['api/*'],
    'allowed_methods' => ['*'],
    'allowed_origins' => $origins,
    'allowed_origins_patterns' => [],
    'allowed_headers' => ['Accept', 'Authorization', 'Content-Type', 'Origin', 'X-Requested-With'],
    'exposed_headers' => [],
    'max_age' => 3600,
    'supports_credentials' => false,
];