import type { CorsOptions } from 'cors';
import { wildcardToSafeRegex } from './wildcardToSafeRegex.js';

export interface CreateWildcardCorsOptionsParams {
  allowedOrigins: string[];
  allowNullOrigin?: boolean;
  methods?: string[];
  allowedHeaders?: string[];
  maxAge?: number;
  optionsSuccessStatus?: number;
}

/**
 * Create CORS options that support wildcard origins while ensuring safe regular expressions.
 */
export function createWildcardCorsOptions({
  allowedOrigins,
  allowNullOrigin = true,
  methods = ['GET', 'HEAD', 'POST', 'OPTIONS'],
  allowedHeaders = ['Content-Type', 'Accept', 'Authorization'],
  maxAge = 86400,
  optionsSuccessStatus = 200
}: CreateWildcardCorsOptionsParams): CorsOptions {
  const normalizedOrigins = allowedOrigins
    .map((origin) => origin.trim().replace(/\/$/, ''))
    .filter(Boolean);

  return {
    origin: (origin, callback): void => {
      if ((origin === undefined || origin === null || origin === 'null') && allowNullOrigin) {
        callback(null, true);
        return;
      }

      if (!origin) {
        callback(null, false);
        return;
      }

      const normalizedOrigin = origin.replace(/\/$/, '');
      const isAllowed = normalizedOrigins.some((allowedOrigin) => {
        if (allowedOrigin.includes('*')) {
          const regex = wildcardToSafeRegex(allowedOrigin);
          return regex.test(normalizedOrigin);
        }

        return allowedOrigin === normalizedOrigin;
      });

      callback(null, isAllowed);
    },
    methods,
    allowedHeaders,
    credentials: true,
    maxAge,
    optionsSuccessStatus
  };
}