FIX_CORS_ERROR

app/Filters/AuthJWT.php

@@ -3,6 +3,7 @@
 namespace App\Filters;
 
 use App\Helpers\JWTToken;
+use App\Filters\Cors;
 use CodeIgniter\Filters\FilterInterface;
 use CodeIgniter\HTTP\RequestInterface;
 use CodeIgniter\HTTP\ResponseInterface;
@@ -18,6 +19,13 @@ use App\Models\LevelContactModel;
 
 class AuthJWT implements FilterInterface
 {
+    protected Cors $corsFilter;
+
+    public function __construct()
+    {
+        $this->corsFilter = new Cors();
+    }
+
     // public function before(RequestInterface $request, $arguments = null)
     // {
     //     $jwt = $request->getHeader('Authorization');
@@ -84,20 +92,20 @@ class AuthJWT implements FilterInterface
         $authHeader = $request->getHeaderLine('Authorization');
 
         if (!$authHeader) {
-            return $this->reject(403, 'Access Forbidden');
+            return $this->reject($request, 403, 'Access Forbidden');
         }
 
         $result = JWTToken::validateJWT($authHeader);
 
         if ($result['status'] !== true) {
-            return $this->reject(401, $result['message']);
+            return $this->reject($request, 401, $result['message']);
         }
 
         $decoded = $result['decoded'];
         $id      = $decoded['id'] ?? null;
 
         if (!$id) {
-            return $this->reject(401, 'Invalid token payload');
+            return $this->reject($request, 401, 'Invalid token payload');
         }
 
         if (isset($decoded['emp_code'])) {
@@ -111,7 +119,7 @@ class AuthJWT implements FilterInterface
 
         if (!$user || $user['token_time_out'] <= time()) {
             $model->update($id, ['token_time_out' => null]);
-            return $this->reject(401, 'Token expired');
+            return $this->reject($request, 401, 'Token expired');
         }
 
         // Refresh sliding expiration
@@ -132,12 +140,20 @@ class AuthJWT implements FilterInterface
         return true;
     }
 
-    private function reject(int $code, string $message)
+    private function reject(RequestInterface $request, int $code, string $message): ResponseInterface
     {
-        return service('response')
-            ->setStatusCode($code)
-            ->setJSON(['status' => $code, 'message' => $message])
-            ->send();
+        $response = service('response');
+        $response->setStatusCode($code);
+        $response->setContentType('application/json');
+        $response->setBody(json_encode([
+            'status'  => $code,
+            'message' => $message,
+        ]));
+
+        // Early before-filter returns skip global Cors after(), so attach CORS here.
+        $this->corsFilter->after($request, $response);
+
+        return $response;
     }