<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class CorsMiddleware
{
    public function handle(Request $request, Closure $next)
    {
        $allowedOrigins = [
            'https://one.creditfair.in'
        ];

        $origin = $request->headers->get('Origin');

        $headers = [
            'Access-Control-Allow-Methods' => 'GET, POST, PUT, PATCH, OPTIONS',
            'Access-Control-Allow-Headers' => 'Origin, Content-Type, Authorization, X-Requested-With, x-cf-customer-app',
            'Access-Control-Allow-Credentials' => 'true',
        ];

        if ($request->getMethod() === 'OPTIONS') {
            if (in_array($origin, $allowedOrigins)) {
                return response('OK', 200)
                    ->withHeaders(array_merge($headers, [
                        'Access-Control-Allow-Origin' => $origin,
                    ]));
            }

            return response('Forbidden', 403);
        }

        $response = $next($request);

        if (in_array($origin, $allowedOrigins)) {
            foreach ($headers as $key => $value) {
                $response->headers->set($key, $value);
            }
            $response->headers->set('Access-Control-Allow-Origin', $origin);
        }

        return $response;
    }
}