<?php
// Allow Flutter web app (localhost:any port) and mobile app to call this API. No output before headers.
@ini_set('display_errors', 0);
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
$allowOrigin = '*';
if ($origin && (strpos($origin, 'http://localhost') === 0 || strpos($origin, 'http://127.0.0.1') === 0)) {
    $allowOrigin = $origin;  // Allow Flutter dev server (e.g. http://localhost:49781)
}
if (($_SERVER['REQUEST_METHOD'] ?? '') === 'OPTIONS') {
    header("Access-Control-Allow-Origin: $allowOrigin");
    header('Access-Control-Allow-Methods: POST, GET, OPTIONS');
    header('Access-Control-Allow-Headers: Content-Type, Authorization');
    header('Access-Control-Max-Age: 86400');
    header('Content-Length: 0');
    http_response_code(204);
    exit;
}
header("Access-Control-Allow-Origin: $allowOrigin");
header('Access-Control-Allow-Methods: POST, GET, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Authorization');
