@@ -0,0 +23,4 @@
+    public function process(Request $request, RequestHandler $handler): Response
+    {
+        $response = $handler->handle($request);
+

@@ -0,0 +39,4 @@
+        if ($this->testRoute($request)) {
+            $response = $response->withHeader('Access-Control-Allow-Origin', $this->buildOrigin($request));
+            $response = $response->withHeader('Access-Control-Allow-Methods', implode(',', $methods));
+            $response = $response->withHeader('Access-Control-Allow-Headers', $requestHeaders);

@@ -0,0 +42,4 @@
+            $response = $response->withHeader('Access-Control-Allow-Headers', $requestHeaders);
+
+            // Optional: Allow Ajax CORS requests with Authorization header
+            $response = $response->withHeader('Access-Control-Allow-Credentials', 'true');

@@ -11,0 +13,4 @@
+        $I->haveHttpHeader('Origin', Api::TEST_ORIGIN);
+        $I->haveHttpHeader('Access-Control-Request-Method', 'GET');
+        $I->sendOptions('/views/working-hours/monthly');
+        $I->seeResponseCodeIs(HttpCode::OK);