<?php

return [

    /*
    |--------------------------------------------------------------------------
    | Cross-Origin Resource Sharing (CORS) Configuration
    |--------------------------------------------------------------------------
    |
    | Here you may configure your settings for cross-origin resource sharing
    | or "CORS". This determines what cross-origin operations may execute
    | in web browsers. You are free to adjust these settings as needed.
    |
    */

    // 🎯 1. 確保包含了你前端呼叫的所有路徑前綴
    'paths' => ['api/*', 'v1/*', 'auth/*', 'sanctum/csrf-cookie'],

    'allowed_methods' => ['*'],

    // 🎯 2. 精準放行本地端 Vite（5173）與雲端生產網域
    'allowed_origins' => [
        'https://fin-buddy.duckdns.org',
        'http://localhost:5173',
        'http://127.0.0.1:5173'
    ],

    'allowed_origins_patterns' => [],

    'allowed_headers' => ['*'],

    'exposed_headers' => [],

    'max_age' => 0,

    // 🎯 3. 超級關鍵！因為你在本地測試有帶登入態（Cookie/Session），這項一定要是 true！
    'supports_credentials' => true,

];