add CORS manager with relative docs

public/index.php

@@ -5,6 +5,7 @@ use Api\Auth\ApiTokenAuthenticator;
 use Api\Core\Router;
 use Api\Core\Request;
 use Api\Core\Response;
+use Api\Core\CorsManager;
 use Api\Core\RateLimiter\RateLimiterInterface;
 use Psr\Log\LoggerInterface;
 
@@ -32,6 +33,48 @@ $router = new Router($container); // vedi nota: router può ricevere container
 $request = new Request();
 $response = new Response();
 
+// CORS handling
+$corsManager = $container->make(CorsManager::class);
+$corsConfig = $container->make(\Api\Core\Config::class)->get('cors', []);
+
+if (!empty($corsConfig['enabled'])) {
+    $origin = $corsManager->getOrigin();
+    $requestOrigin = $_SERVER['HTTP_ORIGIN'] ?? 'none';
+    
+    // Log CORS request details for debugging
+    $logger->debug('CORS request received', [
+        'request_origin' => $requestOrigin,
+        'allowed_origin' => $origin,
+        'is_preflight' => $corsManager->isPreflightRequest(),
+        'method' => $_SERVER['REQUEST_METHOD'],
+        'path' => $request->path()
+    ]);
+    
+    // Apply CORS headers to all responses
+    $corsManager->applyHeaders();
+    
+    // Handle preflight OPTIONS requests
+    if ($corsManager->isPreflightRequest()) {
+        $corsManager->handlePreflight();
+    }
+}
+
+// Diagnostic CORS endpoint (no auth required)
+if ($request->path() === '/cors-check' && $request->method() === 'GET') {
+    $corsManager = $container->make(CorsManager::class);
+    $corsConfig = $container->make(\Api\Core\Config::class)->get('cors', []);
+    
+    $response->json([
+        'cors_enabled' => !empty($corsConfig['enabled']),
+        'request_origin' => $_SERVER['HTTP_ORIGIN'] ?? null,
+        'allowed_origins' => $corsConfig['allowed_origins'] ?? [],
+        'is_origin_allowed' => $corsManager->isOriginAllowed(),
+        'is_preflight' => $corsManager->isPreflightRequest(),
+        'request_method' => $_SERVER['REQUEST_METHOD'],
+        'headers_sent' => function_exists('getallheaders') ? getallheaders() : $_SERVER,
+    ]);
+}
+
 // Autenticazione separata per le API esterne
 if (strpos($request->path(), '/api/') === 0) {
     try {