const DEFAULT_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'];
const DEFAULT_HEADERS = ['Content-Type', 'Authorization', 'X-CSRF-Token'];
/** Build CORS headers for a given request origin. */
export function getCorsHeaders(requestOrigin, config) {
    const headers = {};
    const allowedOrigin = resolveOrigin(requestOrigin, config.allowedOrigins);
    if (!allowedOrigin)
        return headers;
    headers['Access-Control-Allow-Origin'] = allowedOrigin;
    headers['Access-Control-Allow-Methods'] = (config.allowedMethods ?? DEFAULT_METHODS).join(', ');
    headers['Access-Control-Allow-Headers'] = (config.allowedHeaders ?? DEFAULT_HEADERS).join(', ');
    if (config.exposedHeaders?.length) {
        headers['Access-Control-Expose-Headers'] = config.exposedHeaders.join(', ');
    }
    if (config.credentials) {
        headers['Access-Control-Allow-Credentials'] = 'true';
    }
    if (config.maxAge !== undefined) {
        headers['Access-Control-Max-Age'] = String(config.maxAge);
    }
    if (config.allowedOrigins !== '*') {
        headers['Vary'] = 'Origin';
    }
    return headers;
}
function resolveOrigin(requestOrigin, allowed) {
    if (allowed === '*')
        return '*';
    if (!requestOrigin)
        return null;
    return allowed.includes(requestOrigin) ? requestOrigin : null;
}
//# sourceMappingURL=cors.js.map