<?php
/**
 * CORS (Cross-Origin Resource Sharing) Handler
 *
 * This file sets the necessary HTTP headers to allow cross-origin requests.
 * It also handles the preflight OPTIONS request required by modern browsers.
 * This should be included at the very top of any PHP file that acts as an API endpoint.
 *
 * In production, you should replace the wildcard '*' or 'http://localhost:3000'
 * with the specific domain of your Vercel frontend for better security.
 */

// Allow specific origin(s) - replace with your Vercel domain in production
header('Access-Control-Allow-Origin: http://localhost:3000');

// Allow credentials (like cookies or session IDs) to be sent with the request
header('Access-Control-Allow-Credentials: true');

// Set the allowed HTTP methods
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');

// Set the allowed HTTP headers
header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With');

// Set the cache time for the preflight request
header('Access-Control-Max-Age: 86400');

// Handle preflight OPTIONS request
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit;
}