CORS configuration for Rails APIs

                  Rails.application.config.middleware.insert_before 0, Rack::Cors do
  # Development CORS - allow any localhost
  allow do
    origins(
      /http:\/\/localhost:\d+/,
      /http:\/\/127\.0\.0\.1:\d+/,
      'http://localhost:5173', # Vite default
      'http://localhost:3001'  # Alternative React dev server
    )

    resource '/api/*',
      headers: :any,
      methods: [:get, :post, :put, :patch, :delete, :options, :head],
      credentials: true,
      expose: ['Authorization', 'X-Request-ID']
  end if Rails.env.development?

  # Production CORS - strict origin checking
  allow do
    origins ENV.fetch('ALLOWED_ORIGINS', '').split(',')

    resource '/api/*',
      headers: :any,
      methods: [:get, :post, :put, :patch, :delete, :options, :head],
      credentials: true,
      expose: ['Authorization', 'X-Request-ID'],
      max_age: 86400 # Cache preflight for 24 hours
  end if Rails.env.production?

  # Public endpoints - no credentials
  allow do
    origins '*'

    resource '/api/public/*',
      headers: :any,
      methods: [:get, :options, :head],
      credentials: false
  end
end