//! CORS Configuration - Contains intentional vulnerabilities
//!
//! Vulnerabilities:
//! - Access-Control-Allow-Origin: *
//! - Permissive CORS with credentials

/// VULNERABILITY: Wildcard CORS origin
/// Allows any website to make requests to the API
pub fn cors_config_wildcard() -> CorsConfig {
    CorsConfig {
        // BLOCK: Access-Control-Allow-Origin: * allows any origin
        allow_origin: "*".to_string(),
        allow_credentials: false,
        allow_methods: vec!["GET", "POST"].iter().map(|s| s.to_string()).collect(),
    }
}

/// VULNERABILITY: CORS allows credentials with permissive origin
/// Combined with dynamic origin reflection, this enables credential theft
pub fn cors_config_with_credentials() -> CorsConfig {
    CorsConfig {
        // BLOCK: CORS allows credentials with overly permissive origin
        allow_origin: "https://*.example.com".to_string(),
        allow_credentials: true,
        allow_methods: vec!["GET", "POST", "PUT", "DELETE"].iter().map(|s| s.to_string()).collect(),
    }
}

#[derive(Debug, Clone)]
pub struct CorsConfig {
    pub allow_origin: String,
    pub allow_credentials: bool,
    pub allow_methods: Vec<String>,
}

impl CorsConfig {
    pub fn to_headers(&self) -> Vec<(String, String)> {
        vec![
            ("Access-Control-Allow-Origin".to_string(), self.allow_origin.clone()),
            ("Access-Control-Allow-Credentials".to_string(), self.allow_credentials.to_string()),
            ("Access-Control-Allow-Methods".to_string(), self.allow_methods.join(", ")),
        ]
    }
}
