#!/usr/bin/env bash

set -euo pipefail

API_BASE="${1:-https://data.busvalley.net/busvalley_new/modules/api/v1}"
ENDPOINT="${2:-/locations}"

echo "== Allowed origin preflight =="
curl -i -X OPTIONS "${API_BASE}${ENDPOINT}" \
  -H "Origin: http://localhost:3002" \
  -H "Access-Control-Request-Method: GET" \
  -H "Access-Control-Request-Headers: Authorization, Content-Type"

echo
echo "== Allowed origin actual request =="
curl -i "${API_BASE}${ENDPOINT}" \
  -H "Origin: http://localhost:3002" \
  -H "Authorization: Bearer test-token"

echo
echo "== Production origin actual request =="
curl -i "${API_BASE}${ENDPOINT}" \
  -H "Origin: https://busvalley.net"

echo
echo "== Disallowed origin check (should NOT include ACAO) =="
curl -i "${API_BASE}${ENDPOINT}" \
  -H "Origin: https://evil.example.com"

