# ============================
#  DYNAMIC CORS WHITELIST
# ============================
<IfModule mod_headers.c>
  
  # Whitelist des domaines autorisés
  # → localhost (avec ou sans port)
  # → laforest.test (local dev)
  # → ecprevelstg.wpengine.com (staging)
  # → esplanadecartier-prevel.ca (prod)
SetEnvIfNoCase Origin "^(https?://localhost(:[0-9]+)?|https?://laforest\.test(:[0-9]+)?|https?://ecprevelstg\.wpengine\.com|https?://esplanadecartier-prevel\.ca)$" ACAO_ORIGIN=$0

<FilesMatch "\.(json|php)$">
  Header always set Access-Control-Allow-Origin "%{ACAO_ORIGIN}e" env=ACAO_ORIGIN
  Header always set Vary "Origin"
  Header always set Access-Control-Allow-Methods "GET, OPTIONS"
  Header always set Access-Control-Allow-Headers "Content-Type, X-Requested-With"
</FilesMatch>

</IfModule>


# ============================
#  OPTIONS method
# ============================
<IfModule mod_rewrite.c>
  RewriteEngine On

  # Permet de répondre aux préflight OPTIONS
  RewriteCond %{REQUEST_METHOD} =OPTIONS
  RewriteRule ^ - [R=204,L]

  # /unites → /unites.json
  RewriteRule ^unites$ unites.json [L]
</IfModule>

