export const getAllowedOrigins = (): (string | RegExp)[] => {
  const origins: (string | RegExp)[] = []

  // Development origins
  if (process.env.NODE_ENV !== "production") {
    origins.push("http://localhost:8081", "http://localhost:8083")
  }

  // Production/staging origins from environment
  if (process.env.RACLETTE_FRONTEND_URL) {
    origins.push(process.env.RACLETTE_FRONTEND_URL)
  }

  // Support multiple frontend URLs (comma-separated)
  if (process.env.RACLETTE_FRONTEND_URLS) {
    const urls = process.env.RACLETTE_FRONTEND_URLS.split(",").map((url) =>
      url.trim(),
    )
    origins.push(...urls)
  }

  // Wildcard subdomain support for preview deployments (be careful with this)
  if (process.env.RACLETTE_ALLOWED_DOMAIN_PATTERN) {
    origins.push(new RegExp(process.env.RACLETTE_ALLOWED_DOMAIN_PATTERN))
  }

  return origins
}
