<?php

it('allows release telemetry headers at PHP-served CORS entry points', function (): void {
    $requiredHeaders = [
        'X-Release-Trace',
        'X-Release-Channel',
        'X-Frontend-Version',
        'Cache-Control',
        'Pragma',
    ];

    $files = [
        app_path('classes/cors_policy.php'),
        app_path('modules/washcertificates/index.php'),
    ];

    foreach ($files as $file) {
        expect(is_file($file))->toBeTrue();
        $content = (string)file_get_contents($file);

        foreach ($requiredHeaders as $header) {
            expect($content)->toContain($header);
        }
    }

    expect((string)file_get_contents(app_path('index.php')))->toContain('cors_policy::preflightResponse');
    expect((string)file_get_contents(app_path('routes/optionsRoute.php')))->toContain('cors_policy::preflightResponse');
});
