<?php

namespace Licenzo\Http\Middleware;

// Prevent direct access
if (!defined('ABSPATH')) {
    exit;
}

use Licenzo\Framework\Http\Request;
use Licenzo\Framework\Http\Response;

class HandleCors
{
    /**
     * Handle an incoming request.
     */
    public function handle(Request $request, \Closure $next)
    {
        $response = $next($request);

        // Add CORS headers — restrict to same-origin (WordPress site URL)
        if ($response instanceof Response) {
            $origin = home_url();
            $response->header('Access-Control-Allow-Origin', $origin);
            $response->header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
            $response->header('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With, X-WP-Nonce');
        }

        return $response;
    }
}
