<?php
/**
 * CORS Configuration
 * Handles Cross-Origin Resource Sharing headers
 */

// Allowed origins - update this with your production domain
$allowedOrigins = [
    'http://localhost:3000',
    'https://vizventuregroup.com',
    'https://www.vizventuregroup.com'
];

// Get the origin of the request
$origin = isset($_SERVER['HTTP_ORIGIN']) ? $_SERVER['HTTP_ORIGIN'] : '';

// Check if the origin is allowed
$allowedOrigin = in_array($origin, $allowedOrigins) ? $origin : $allowedOrigins[0];

// Set CORS headers
header("Access-Control-Allow-Origin: $allowedOrigin");
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With');
header('Access-Control-Allow-Credentials: true');
header('Access-Control-Max-Age: 86400'); // 24 hours

// Handle preflight OPTIONS request
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit();
}
