local kong_meta = require "kong.meta"

local CustomCORS = {PRIORITY = 1140, VERSION = kong_meta.version}

function CustomCORS:access(conf)
    if kong.request.get_method() ~= "OPTIONS" or
        not kong.request.get_header("Origin") or
        not kong.request.get_header("Access-Control-Request-Method") then
        return
    end

    kong.response
        .set_header("X-Debug-Trace-Id", kong.ctx.shared.trace_id or "-")
    kong.response.set_header("Access-Control-Allow-Headers",
                             "accept, content-type, authorization")
    kong.response.set_header("Access-Control-Allow-Methods",
                             "POST, GET, OPTIONS, PUT, DELETE, PATCH")
    kong.response.set_header("Access-Control-Allow-Origin", "*")
    kong.response.add_header("Access-Control-Expose-Headers",
                             "x-debug-trace-id,x-kong-proxy-latency,x-kong-upstream-latency,x-kong-response-latency,x-pingcap-requestid,x-ratelimit-remaining-minute,x-ratelimit-limit-minute,x-ratelimit-reset")
    kong.response.exit(204)
end

return CustomCORS