public class CorsPolicy
{
    public bool AllowAnyHeader { get; }
    public bool AllowAnyMethod { get; }
    public bool AllowAnyOrigin { get; }
    public Func<string, bool> IsOriginAllowed { get; private set; }
    public IList<string> ExposedHeaders { get; } = new List<string>();
    public IList<string> Headers { get; } = new List<string>();
    public IList<string> Methods { get; } = new List<string>();
    public IList<string> Origins { get; } = new List<string>();
    public TimeSpan? PreflightMaxAge { get; set; }
    public bool SupportsCredentials { get; set; }

public class CorsPolicyBuilder 
{
    CorsPolicyBuilder WithOrigins(params string[] origins);
    CorsPolicyBuilder WithHeaders(params string[] headers);
    CorsPolicyBuilder WithExposedHeaders(params string[] exposedHeaders);
    CorsPolicyBuilder WithMethods(params string[] methods);
    CorsPolicyBuilder AllowCredentials();
    CorsPolicyBuilder DisallowCredentials();
    CorsPolicyBuilder AllowAnyOrigin();
    CorsPolicyBuilder AllowAnyMethod();
    CorsPolicyBuilder AllowAnyHeader();
    CorsPolicyBuilder SetPreflightMaxAge(TimeSpan preflightMaxAge);
    CorsPolicyBuilder SetIsOriginAllowed(Func<string, bool> isOriginAllowed);
    CorsPolicyBuilder SetIsOriginAllowedToAllowWildcardSubdomains();
    CorsPolicy Build();
}

// DefaultCorsPolicyProvider的GetPolicyAsync()
public Task<CorsPolicy?> GetPolicyAsync(HttpContext context, string? policyName)
{
    if (context == null){
        throw new ArgumentNullException(nameof(context));
    }

    policyName ??= _options.DefaultPolicyName;
    if (_options.PolicyMap.TryGetValue(policyName, out var result)) {
        return result.policyTask!;
    }

    return NullResult;
}

// CorsOptions
public void AddDefaultPolicy(CorsPolicy policy);
public void AddDefaultPolicy(Action<CorsPolicyBuilder> configurePolicy);
public void AddPolicy(string name, CorsPolicy policy);
public void AddPolicy(string name, Action<CorsPolicyBuilder> configurePolicy);
public CorsPolicy? GetPolicy(string name);

public CorsResult EvaluatePolicy(HttpContext context, CorsPolicy policy)
{
    // ...
    if (policy.AllowAnyOrigin && policy.SupportsCredentials) {
        throw new ArgumentException(Resources.InsecureConfiguration, nameof(policy));
    }

    var requestHeaders = context.Request.Headers;
    var origin = requestHeaders[CorsConstants.Origin];

    var isOptionsRequest = HttpMethods.IsOptions(context.Request.Method);
    var isPreflightRequest = isOptionsRequest 
        && requestHeaders.ContainsKey(CorsConstants.AccessControlRequestMethod);

    var corsResult = new CorsResult {
        IsPreflightRequest = isPreflightRequest,
        IsOriginAllowed = IsOriginAllowed(policy, origin),
    };

    if (isPreflightRequest) {
        //预检请求
        EvaluatePreflightRequest(context, policy, corsResult);
    }
    else {
        //非预检请求
        EvaluateRequest(context, policy, corsResult);
    }

    return corsResult;
}

private static void PopulateResult(HttpContext context, 
    CorsPolicy policy, 
    CorsResult result
)
{
    var headers = context.Request.Headers;
    if (policy.AllowAnyOrigin) {
        result.AllowedOrigin = CorsConstants.AnyOrigin;
        result.VaryByOrigin = policy.SupportsCredentials;
    } else {
        var origin = headers[CorsConstants.Origin];
        result.AllowedOrigin = origin;
        result.VaryByOrigin = policy.Origins.Count > 1 
            || !policy.IsDefaultIsOriginAllowed;
    }
    
    // 支持凭据
    result.SupportsCredentials = policy.SupportsCredentials;
    // 预检请求超时时间
    result.PreflightMaxAge = policy.PreflightMaxAge;

    // https://fetch.spec.whatwg.org/#http-new-header-syntax
    AddHeaderValues(result.AllowedExposedHeaders, policy.ExposedHeaders);
    
    // 允许的HTTP方法
    var allowedMethods = policy.AllowAnyMethod ?
        new[] { result.IsPreflightRequest ? 
                (string)headers[CorsConstants.AccessControlRequestMethod] : 
                context.Request.Method } :
        policy.Methods;
    AddHeaderValues(result.AllowedMethods, allowedMethods);
    
    // 允许的HTTP头
    var allowedHeaders = policy.AllowAnyHeader ?
        headers.GetCommaSeparatedValues(CorsConstants.AccessControlRequestHeaders) :
        policy.Headers;
    AddHeaderValues(result.AllowedHeaders, allowedHeaders);
}

public Task Invoke(HttpContext context, ICorsPolicyProvider corsPolicyProvider)
{
    // ...
    if (!context.Request.Headers.ContainsKey(CorsConstants.Origin)) {
        return _next(context);
    }
    
    // [DisableCors]
    var corsMetadata = endpoint?.Metadata.GetMetadata<ICorsMetadata>();
    if (corsMetadata is IDisableCorsAttribute) {
        var isOptionsRequest = HttpMethods.IsOptions(context.Request.Method);
        var isCorsPreflightRequest = isOptionsRequest 
            && context.Request.Headers.ContainsKey(CorsConstants.AccessControlRequestMethod);
        if (isCorsPreflightRequest) {
            // If this is a preflight request, and we disallow CORS, complete the request
            context.Response.StatusCode = StatusCodes.Status204NoContent;
            return Task.CompletedTask;
        }

        return _next(context);
    }

    // ...
    // [EnableCors]
    else if (corsMetadata is IEnableCorsAttribute enableCorsAttribute &&
        enableCorsAttribute.PolicyName != null) {
        // ...
        // Evaluate && Apply
        return EvaluateAndApplyPolicy(context, corsPolicy);
        async Task InvokeCoreAwaited(HttpContext context, Task<CorsPolicy?> policyTask) {
            var corsPolicy = await policyTask;
            await EvaluateAndApplyPolicy(context, corsPolicy);
        }
    }
}