import { NextResponse } from "next/server";

const ALLOWED_ORIGIN =
  process.env.NEXT_PUBLIC_APP_URL || "https://mawidi.com";

export function corsHeaders(
  methods: string = "GET, POST, OPTIONS",
): Record<string, string> {
  return {
    "Access-Control-Allow-Origin": ALLOWED_ORIGIN,
    "Access-Control-Allow-Methods": methods,
    "Access-Control-Allow-Headers": "Content-Type, Authorization, x-csrf-token",
    "Access-Control-Max-Age": "86400",
  };
}

export function corsResponse(methods?: string): NextResponse {
  return new NextResponse(null, {
    status: 204,
    headers: corsHeaders(methods),
  });
}
