<?php

declare(strict_types=1);

/**
 * APO-198 Card 6 — CORS allow-list policy for the MCP endpoint.
 *
 * Default posture: empty allow-list → reject all browser-origin requests.
 * Operator adds permitted origins via Site Settings; full-origin match only
 * (no wildcards; no path component; protocol-distinct).
 *
 * Locked: full-parity-mcp-2026-05-10.md §8.
 */
final class MyronMcpCorsPolicy
{
    /**
     * @param list<string> $allowedOrigins  full-origin strings (no wildcards)
     */
    public function __construct(
        private readonly array $allowedOrigins,
    ) {
    }

    public function isOriginAllowed(string $origin): bool
    {
        $origin = trim($origin);
        if ($origin === '') {
            // No Origin header — non-browser caller (curl, MCP CLI). Allowed.
            return true;
        }
        foreach ($this->allowedOrigins as $allowed) {
            if ($allowed === $origin) {
                return true;
            }
        }
        return false;
    }

    /**
     * @return list<string>
     */
    public function allowedOrigins(): array
    {
        return $this->allowedOrigins;
    }
}
