Enhance CORS exposed headers handling for dynamic response (#26)

- Update CorsService to merge existing exposed headers with configured
- Add deduplication for exposed headers

Author: yinheli

src/CorsService.php

@@ -260,8 +260,17 @@ private function configureAllowCredentials(Response $response, Request $request)
 
     private function configureExposedHeaders(Response $response, Request $request): void
     {
+        $existingExposedHeaders = $response->headers->get('Access-Control-Expose-Headers');
+        $exposedHeaders = $existingExposedHeaders ? array_map('trim', explode(',', $existingExposedHeaders)) : [];
+
         if ($this->exposedHeaders) {
-            $response->headers->set('Access-Control-Expose-Headers', implode(', ', $this->exposedHeaders));
+            $exposedHeaders = array_merge($this->exposedHeaders, $exposedHeaders);
+        }
+
+        $uniqueExposedHeaders = array_unique(array_filter($exposedHeaders));
+
+        if (!empty($uniqueExposedHeaders)) {
+            $response->headers->set('Access-Control-Expose-Headers', implode(', ', $uniqueExposedHeaders));
         }
     }
 

tests/CorsTest.php

@@ -535,6 +535,43 @@ public function itDoesntSetAccessControlAllowOriginWithoutOrigin(): void
         $this->assertFalse($response->headers->has('Access-Control-Allow-Origin'));
     }
 
+    /**
+     * @test
+     */
+    public function itConfiguresExposedHeadersWhenResponseHasNoExistingHeaders(): void
+    {
+        $app = $this->createStackedApp([], [
+            'Access-Control-Expose-Headers' => 'X-Custom-1, X-Custom-2',
+        ]);
+        $request = $this->createValidActualRequest();
+
+        $response = $app->handle($request);
+
+        $this->assertTrue($response->headers->has('Access-Control-Expose-Headers'));
+        $this->assertEquals('X-Custom-1, X-Custom-2', $response->headers->get('Access-Control-Expose-Headers'));
+    }
+
+    /**
+     * @test
+     */
+    public function itMergesExposedHeadersWhenResponseHasExistingHeaders(): void
+    {
+        $app = $this->createStackedApp(
+            [
+                'exposedHeaders' => ['X-Option-1', 'X-Option-2'],
+            ],
+            [
+                'Access-Control-Expose-Headers' => 'X-Custom-1',
+            ]
+        );
+        $request = $this->createValidActualRequest();
+
+        $result = $app->handle($request);
+
+        $this->assertTrue($result->headers->has('Access-Control-Expose-Headers'));
+        $this->assertEquals('X-Option-1, X-Option-2, X-Custom-1', $result->headers->get('Access-Control-Expose-Headers'));
+    }
+
     private function createValidActualRequest(): Request
     {
         $request  = new Request();