/* =====================================================================
   http.js — gemeinsame HTTP-Helfer (CORS, JSON-Responses)
   ===================================================================== */

export function corsHeaders() {
  // TODO: sobald die Domain final steht, statt "*" die echte Domain eintragen.
  return {
    "Access-Control-Allow-Origin": "*",
    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
    "Access-Control-Allow-Headers": "Content-Type, Authorization",
  };
}

export function json(data, status = 200) {
  return new Response(JSON.stringify(data), {
    status,
    headers: { "Content-Type": "application/json", ...corsHeaders() },
  });
}