//! CORS layer factory for the daemon HTTP server.

use tower_http::cors::{AllowHeaders, AllowOrigin, CorsLayer};

/// Return a permissive CorsLayer for local daemon IPC.
///
/// All method and header names are static strings guaranteed to be valid
/// HTTP tokens — `.parse()` is infallible here.
pub fn default_cors_layer() -> CorsLayer {
    CorsLayer::new()
        .allow_origin(AllowOrigin::any())
        .allow_methods([
            "GET".parse().expect("static HTTP method"),
            "POST".parse().expect("static HTTP method"),
            "PUT".parse().expect("static HTTP method"),
            "DELETE".parse().expect("static HTTP method"),
            "PATCH".parse().expect("static HTTP method"),
            "OPTIONS".parse().expect("static HTTP method"),
        ])
        .allow_headers(AllowHeaders::any())
        .expose_headers([
            "Content-Type".parse().expect("static HTTP header"),
            "X-Session-Id".parse().expect("static HTTP header"),
            "X-Request-Id".parse().expect("static HTTP header"),
        ])
}