/**
 * Enforces the trusted-origins CORS allowlist on a raw Response from Better Auth.
 * Better Auth reflects the request Origin into Access-Control-Allow-Origin
 * regardless of the trustedOrigins config, allowing credentialed cross-origin reads
 * from arbitrary attacker origins. This wrapper strips CORS headers for any origin
 * not in the allowlist. (GRO-2586)
 */
export function enforceAuthCors(
  requestOrigin: string | undefined,
  trustedOrigins: string[],
  res: Response
): Response {
  const headers = new Headers(res.headers);
  if (requestOrigin && trustedOrigins.includes(requestOrigin)) {
    headers.set("Access-Control-Allow-Origin", requestOrigin);
    headers.set("Access-Control-Allow-Credentials", "true");
  } else {
    headers.delete("Access-Control-Allow-Origin");
    headers.delete("Access-Control-Allow-Credentials");
  }
  return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
}