# CORS za web klijent (Expo web / PWA na drugom originu, npr. localhost:8081 ili poseban domen).
# Interni API sa token-auth (Authorization header, ne cookie) → Allow-Origin * je prihvatljiv.
# Kad se web build hostuje NA znservis.ba (isti origin), CORS se i ne koristi — ovo ne smeta.

RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]



<IfModule mod_headers.c>
  Header always set Access-Control-Allow-Origin "*"
  Header always set Access-Control-Allow-Methods "GET, POST, PATCH, DELETE, OPTIONS"
  Header always set Access-Control-Allow-Headers "Authorization, Content-Type"
  Header always set Access-Control-Max-Age "86400"
</IfModule>

# Preflight (OPTIONS) → vrati 204 odmah, prije nego PHP/auth stigne da odbije.
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_METHOD} =OPTIONS
  RewriteRule ^ - [R=204,L]
</IfModule>
