<?php
declare (strict_types=1);

namespace app\middleware;

use think\facade\Config;
use think\Response;

class AdminResponse
{

    public function handle($request, \Closure $next): Response
    {
        $response = $next($request);
        $origin = $request->header('origin', '');
        $whitelist = Config::get('apiadmin.CORS_ORIGIN_WHITELIST', []);
        if ($origin && in_array($origin, $whitelist, true)) {
            $response->header(['Access-Control-Allow-Origin' => $origin]);
        }
        $response->header([
            'Vary'                             => 'Origin',
            'Access-Control-Allow-Methods'     => 'POST,GET',
            'Access-Control-Allow-Headers'     => 'Api-Auth,token,Authorization,Content-Type,X-Requested-With',
            'Access-Control-Allow-Credentials' => 'true',
        ]);
        return $response;
    }
}