1import { NextRequest, NextResponse } from 'next/server'23const allowedOrigins = new Set([4 'https://app.example.com',5 'https://admin.example.com',6])78function corsHeaders(origin: string | null) {9 if (!origin || !allowedOrigins.has(origin)) return null1011 return {12 'Access-Control-Allow-Origin': origin,13 'Access-Control-Allow-Credentials': 'true',14 'Access-Control-Allow-Methods': 'GET, POST, PATCH, DELETE, OPTIONS',15 'Access-Control-Allow-Headers': 'Authorization, Content-Type, X-CSRF-Token',16 'Access-Control-Max-Age': '600',17 Vary: 'Origin',18 }19}2021export async function OPTIONS(request: NextRequest) {22 const headers = corsHeaders(request.headers.get('origin'))23 if (!headers) {24 return new NextResponse(null, { status: 403 })25 }26 return new NextResponse(null, { status: 204, headers })27}2829export async function GET(request: NextRequest) {30 const headers = corsHeaders(request.headers.get('origin'))31 if (!headers) {32 return NextResponse.json({ error: 'Origin not allowed' }, { status: 403 })33 }3435 const user = await requireAuthenticatedUser(request)36 const data = await loadUserData(user.id)37 return NextResponse.json(data, { headers })38}
