<?php

return [
    'paths' => ['api/*', 'sanctum/csrf-cookie'],

    'allowed_methods' => ['*'],

    // ✅ Allow both localhost (for testing) and production frontend
    'allowed_origins' => [
        'http://localhost:5173',
        'http://127.0.0.1:5173',
        'https://nphmapp.rccgphm.org' // ✅ Add your deployed frontend URL
    ],

    'allowed_origins_patterns' => [],

    'allowed_headers' => ['*'],

    'exposed_headers' => [],

    'max_age' => 0,

    // ✅ Must be `true` if using `withCredentials: true` (Sanctum, JWT, sessions)
    'supports_credentials' => true,
];
