#!/bin/bash

# Test CORS Configuration Script
# Tests if the server is returning correct CORS headers

echo "Testing CORS configuration for api.muaziin.sa"
echo "================================================"
echo ""

# Test 1: From https://muaziin.sa
echo "Test 1: Request from https://muaziin.sa"
curl -s -I -H "Origin: https://muaziin.sa" \
     -H "Access-Control-Request-Method: GET" \
     -H "Access-Control-Request-Headers: Content-Type" \
     -X OPTIONS \
     https://muaziin.sa/api/public/works | grep -i "access-control"
echo ""

# Test 2: From https://www.muaziin.sa
echo "Test 2: Request from https://www.muaziin.sa"
curl -s -I -H "Origin: https://www.muaziin.sa" \
     -H "Access-Control-Request-Method: GET" \
     -H "Access-Control-Request-Headers: Content-Type" \
     -X OPTIONS \
     https://muaziin.sa/api/public/works | grep -i "access-control"
echo ""

# Test 3: From https://muaziin.sa
echo "Test 3: Request from https://muaziin.sa"
curl -s -I -H "Origin: https://muaziin.sa" \
     -H "Access-Control-Request-Method: GET" \
     -H "Access-Control-Request-Headers: Content-Type" \
     -X OPTIONS \
     https://muaziin.sa/api/public/works | grep -i "access-control"
echo ""

# Test 4: Actual GET request
echo "Test 4: Actual GET request from https://muaziin.sa"
curl -s -H "Origin: https://muaziin.sa" \
     https://muaziin.sa/api/public/contact | grep -c "email" > /dev/null && echo "✓ API returns data" || echo "✗ API error"
echo ""

echo "================================================"
echo "Expected result:"
echo "  Access-Control-Allow-Origin should match the Origin header"
echo "  For https://muaziin.sa → Access-Control-Allow-Origin: https://muaziin.sa"
echo ""
echo "If you see 'localhost:5173' instead, the server needs to be restarted!"