x-server-mobile/backend/app/middleware/CorsMiddleware.php

<?php

namespace app\middleware;

use Webman\Http\Request;
use Webman\Http\Response;

class CorsMiddleware
{
    public function process(Request $request, callable $handler): Response
    {
        // 处理 OPTIONS 预检请求
        if ($request->method() === 'OPTIONS') {
            $response = response('');
        } else {
            $response = $handler($request);
        }

        // 添加 CORS 头
        $response->withHeader('Access-Control-Allow-Origin', '*')
            ->withHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
            ->withHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization')
            ->withHeader('Access-Control-Max-Age', '86400');

        return $response;
    }
}