<?php

declare(strict_types=1);

/*
 * Cross-Origin Resource Sharing (CORS) configuration.
 *
 * The portfolio site at scopeforged.com makes browser-side GET requests to
 * portal.scopeforged.com/api/v1/achievements (and /tags). Allowed origins
 * are explicit — no wildcard — so credentials/cookies stay safe even if a
 * future endpoint accepts them. Adding a new portfolio domain is a one-line
 * change here.
 */

return [

    'paths' => ['api/*', 'sanctum/csrf-cookie'],

    'allowed_methods' => ['GET', 'OPTIONS'],

    'allowed_origins' => [
        'https://scopeforged.com',
        'https://www.scopeforged.com',
        'http://scopeforged.test:8000',
        'http://localhost:3000',
    ],

    'allowed_origins_patterns' => [],

    'allowed_headers' => ['Accept', 'Content-Type', 'X-Requested-With'],

    'exposed_headers' => [],

    'max_age' => 3600,

    'supports_credentials' => false,

];