package middleware

import "github.com/gin-gonic/gin"

// csp is the Content-Security-Policy for HTML responses.
//
// 'unsafe-inline' is required because templates embed inline <script> and
// <style> blocks (Go html/template is the XSS defense for those); the
// directive list restricts everything else (scripts can only load from the
// pinned CDN hosts, no third-party frames, no other origins for fetch).
// Tighten further once the third-party assets are vendored locally (see
// SECURITY_TODO P2-9).
const csp = "default-src 'self'; " +
	"script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://cdn.tailwindcss.com; " +
	"style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; " +
	"img-src 'self' data: https: http:; " +
	"font-src 'self' data: https:; " +
	"connect-src 'self'; " +
	"frame-ancestors 'none'; " +
	"base-uri 'self'; " +
	"form-action 'self'"

// SecurityHeaders sets hardening response headers on every response:
// CSP, nosniff, clickjacking (X-Frame-Options + frame-ancestors),
// referrer policy, and HSTS when the request arrived over HTTPS.
// Register it before all other middleware so the headers are present even
// on rejected (403/redirect) responses.
func SecurityHeaders() gin.HandlerFunc {
	return func(c *gin.Context) {
		c.Header("Content-Security-Policy", csp)
		c.Header("X-Content-Type-Options", "nosniff")
		c.Header("X-Frame-Options", "DENY")
		c.Header("Referrer-Policy", "strict-origin-when-cross-origin")
		c.Header("Permissions-Policy", "camera=(), microphone=(), geolocation=()")
		if IsHTTPSRequest(c) {
			// includeSubDomains is deliberately omitted: some subdomains of
			// the site may still be served over plain HTTP.
			c.Header("Strict-Transport-Security", "max-age=31536000")
		}
		c.Next()
	}
}