<?php

declare(strict_types=1);

/*
| The SPA is served from its own origin (Vite in development, a static host in
| production), so it is a cross-origin caller. Credentials must be supported
| for Sanctum's cookie-based session guard, which forbids a wildcard origin.
*/

$frontend = rtrim((string) env('FRONTEND_URL', 'http://localhost:5173'), '/');

return [

    'paths' => ['api/*', 'sanctum/csrf-cookie', 'login', 'logout'],

    'allowed_methods' => ['*'],

    'allowed_origins' => array_values(array_unique(array_filter([
        $frontend,
    ]))),

    'allowed_origins_patterns' => [],

    'allowed_headers' => ['*'],

    'exposed_headers' => [],

    'max_age' => 0,

    'supports_credentials' => true,

];
