//! CORS layer factory for the daemon HTTP (IPC) server.
//!
//! Since the daemon only listens on `127.0.0.1`, the CORS policy is
//! intentionally permissive.  These settings are still required because
//! Axum rejects cross-origin requests unless a CORS layer is present.

use tower_http::cors::{AllowHeaders, AllowOrigin, CorsLayer};

/// Return a permissive [`CorsLayer`] for local daemon IPC.
///
/// - **Origin**: any (`*`)
/// - **Methods**: `GET`, `POST`, `PUT`, `DELETE`, `PATCH`, `OPTIONS`
/// - **Headers**: `Content-Type`, `Authorization`, `X-Session-Id`,
///   `X-Request-Id`, `User-Agent`
/// Return a permissive [`CorsLayer`] for local daemon IPC.
///
/// - **Origin**: any (`*`)
/// - **Methods**: `GET`, `POST`, `PUT`, `DELETE`, `PATCH`, `OPTIONS`
/// - **Headers**: `Content-Type`, `Authorization`, `X-Session-Id`,
///   `X-Request-Id`, `User-Agent`
///
/// Since the daemon only listens on localhost, any origin is allowed.
/// The exposed headers let the browser JS read session/request IDs.
pub fn default_cors_layer() -> CorsLayer {
    CorsLayer::new()
        .allow_origin(AllowOrigin::any()) // permissive — daemon is localhost-only
        .allow_methods([
            "GET".parse().unwrap(),
            "POST".parse().unwrap(),
            "PUT".parse().unwrap(),
            "DELETE".parse().unwrap(),
            "PATCH".parse().unwrap(),
            "OPTIONS".parse().unwrap(),
        ]) // standard REST methods
        .allow_headers(AllowHeaders::any())
        .expose_headers([
            "Content-Type".parse().unwrap(),
            "X-Session-Id".parse().unwrap(),
            "X-Request-Id".parse().unwrap(),
        ]) // headers exposed to the browser JS
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_default_cors_layer_constructs() {
        let _layer = default_cors_layer();
    }
}