package middleware

import (
	"strings"

	"git.lzcwy.cn/zhengchiliu/zt-closet-manage-backend/global"
	"github.com/gin-gonic/gin"
)

// CORS 跨域中间件。
// 允许来源通过 Server.Domain 配置，自动放行其 http/https 两种协议的 Origin。
// 未配置时回退为 *（保持兼容）。
func CORS() gin.HandlerFunc {
	domain := ""
	if global.ServerSetting != nil {
		domain = strings.TrimSpace(global.ServerSetting.Domain)
	}

	return func(c *gin.Context) {
		origin := c.GetHeader("Origin")
		allowOrigin := "*"
		if domain != "" && domain != "*" {
			allowOrigin = ""
			if originAllowed(origin, domain) {
				allowOrigin = origin
			}
		}

		if allowOrigin != "" {
			c.Header("Access-Control-Allow-Origin", allowOrigin)
		}
		c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
		c.Header("Access-Control-Allow-Headers", "Origin, Content-Type, Authorization")
		c.Header("Access-Control-Expose-Headers", "Content-Length")
		c.Header("Access-Control-Max-Age", "86400")

		if c.Request.Method == "OPTIONS" {
			c.AbortWithStatus(204)
			return
		}

		c.Next()
	}
}

// originAllowed 判断 Origin 是否命中配置域名（http/https，忽略尾部斜杠）。
func originAllowed(origin, domain string) bool {
	o := strings.TrimSuffix(strings.TrimSpace(origin), "/")
	return o == "https://"+domain || o == "http://"+domain
}