<?php
// Menangani preflight request OPTIONS
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    header('Access-Control-Allow-Origin: https://drarnya.itcprogram.com');
    header('Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS');
    header('Access-Control-Allow-Headers: Authorization, Content-Type');
    header('Access-Control-Max-Age: 86400');
    http_response_code(200);
    exit;
}

// Header untuk semua response
header('Access-Control-Allow-Origin: https://drarnya.itcprogram.com');
header('Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS');
header('Access-Control-Allow-Headers: Authorization, Content-Type');
header('Content-Type: application/json');

// Lanjutkan dengan kode asli...
function validateToken() {
    $headers = getallheaders();
    $authHeader = $headers['Authorization'] ?? '';
    $token = str_replace('Bearer ', '', $authHeader);
    if (!$token) {
        http_response_code(401);
        die(json_encode(['error' => 'Token required']));
    }
    $payload = json_decode(base64_decode($token), true);
    if (!$payload || $payload['exp'] < time()) {
        http_response_code(401);
        die(json_encode(['error' => 'Invalid or expired token']));
    }
    return $payload;
}