type RouteRule = {
  path: string;
  methods?: string[];
};

const API_ALLOWLIST: RouteRule[] = [
  { path: "/api/auth/login", methods: ["POST"] },
  { path: "/api/auth/register", methods: ["POST"] },
  { path: "/api/config/global", methods: ["GET"] },
];

export function isAllowlistedApiPath(path: string, method?: string) {
  const requestMethod = method?.toUpperCase() ?? "GET";
  return API_ALLOWLIST.some((rule) => {
    if (rule.path !== path) {
      return false;
    }
    if (!rule.methods || rule.methods.length === 0) {
      return true;
    }
    return rule.methods.includes(requestMethod);
  });
}