// The MCP endpoint, OAuth's token endpoints and their metadata are called by agents, including
// ones running in a browser on another origin. They read no cookies (only bearer tokens, or nothing),
// so answering any origin can't let a web page act as a signed-in user.

const CORS_HEADERS = {
  "Access-Control-Allow-Origin": "*",
  "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
  "Access-Control-Allow-Headers": "Authorization, Content-Type, Accept, Mcp-Protocol-Version, Mcp-Session-Id, Last-Event-ID",
  "Access-Control-Expose-Headers": "WWW-Authenticate, Mcp-Protocol-Version, Mcp-Session-Id",
  "Access-Control-Max-Age": "86400",
};

export function withCors(response: Response) {
  for (const [key, value] of Object.entries(CORS_HEADERS)) response.headers.set(key, value);
  return response;
}

export const corsJson = (body: unknown, status = 200, headers: Record<string, string> = {}) =>
  withCors(Response.json(body, { status, headers: { "Cache-Control": "no-store", ...headers } }));

/** The answer to a CORS preflight request. */
export const preflight = () => withCors(new Response(null, { status: 204 }));