using Microsoft.AspNetCore.Mvc.Filters;

namespace FinlyticBackend.Util;

/// <summary>
/// A global authorization filter that short-circuits authorization checks for HTTP OPTIONS requests.
/// This is required for CORS preflight to succeed on endpoints protected with [Authorize]:
/// the browser sends a parameter-less OPTIONS request before the real request, and any 401
/// response on that preflight causes the actual request to be blocked with a CORS error.
/// </summary>
public class AllowOptionsFilter : IAuthorizationFilter
{
    public void OnAuthorization(AuthorizationFilterContext context)
    {
        if (context.HttpContext.Request.Method == HttpMethods.Options)
        {
            // Return 204 No Content immediately — the manual CORS middleware in Program.cs
            // has already written the Access-Control-Allow-* headers.
            context.Result = new Microsoft.AspNetCore.Mvc.StatusCodeResult(204);
        }
    }
}