<?php

/**
 * Public Mini payment pages are HTML-proxied through ladl.link while Vite assets
 * and Mini pay endpoints live on mini.ladill.com. Browsers require CORS for those
 * cross-origin module scripts and JSON pay posts.
 */
return [

    'paths' => [
        'q/*',
        'build/*',
        'images/*',
        'sanctum/csrf-cookie',
    ],

    'allowed_methods' => ['*'],

    'allowed_origins' => array_values(array_filter([
        'https://ladl.link',
        'https://www.ladl.link',
        'https://mini.ladill.com',
        env('APP_URL') ? rtrim((string) env('APP_URL'), '/') : null,
    ])),

    'allowed_origins_patterns' => [
        // Public short-link host and optional subdomains.
        '#^https://([a-z0-9-]+\.)?ladl\.link$#i',
        // Platform family (custom / satellite hosts that may proxy Mini HTML).
        '#^https://([a-z0-9-]+\.)?ladill\.com$#i',
    ],

    'allowed_headers' => ['*'],

    'exposed_headers' => [],

    'max_age' => 60 * 60,

    'supports_credentials' => false,

];