/**
 * Security-header policy — the SINGLE SOURCE OF TRUTH for the web app's
 * security headers (TASK-0134, OWASP ASVS L2 §7 / §9).
 *
 * Why here: the policy must be applied by `apps/web/next.config.mjs` (the
 * `headers()` API — a Node script that bundles Next's webpack toolchain
 * cannot import a bare `.ts` module through the bundler) AND asserted by
 * the security suite (`tests/security/headers.test.ts`). Both consumers
 * import this exact module, so the web headers and the test expectations
 * cannot drift. The API (`apps/api/src/main.ts`) serves JSON (CSP
 * `default-src 'none'`) and keeps its own small header block; the web is
 * the only surface that renders HTML to end users.
 *
 * The CSP is deliberately app-specific (documented per directive):
 *
 *  - `default-src 'self'` — nothing from any other origin by default.
 *  - `script-src 'self' 'unsafe-inline'` — `'self'` for the chunked static
 *    JS; `'unsafe-inline'` is REQUIRED by Next.js 14 App Router: the SSR
 *    flight payload is delivered as inline `<script>self.__next_f.push(...)`
 *    scripts (no external flight file). No third-party script origin.
 *    Dev adds `'unsafe-eval'` (Next 14 dev chunks embed inline source maps
 *    via eval(); without it client hydration is blocked) — production never
 *    carries 'unsafe-eval'.
 *  - `style-src 'self' 'unsafe-inline'` — Tailwind + next/font + inline
 *    style attributes used by the editor (block decorations). No external
 *    stylesheet origin.
 *  - `img-src 'self' data: blob:` — same-origin static media + the file
 *    pipeline serves user images through the API (same-origin `/files/*`)
 *    or as data:/blob: URLs in the editor canvas.
 *  - `font-src 'self'` — next/font self-hosts woff2 under /_next/static/media.
 *  - `connect-src 'self'` + (env) API + WS origins — fetch() to the same
 *    origin plus the configured API/WS endpoints (dev: localhost:4000/4001).
 *  - `frame-src 'self' http: https:` — the editor's EmbedBlock and the
 *    PDF/file preview iframes load user-supplied URLs (sandboxed with the
 *    `sandbox` attribute; see block-renderer.tsx). `default-src 'self'`
 *    would break this feature, so frame-src is explicit.
 *  - `object-src 'none'` — no plugins (Flash/etc.) anywhere.
 *  - `base-uri 'self'` — blocks `<base href>` injection (DOM hijack).
 *  - `form-action 'self'` — forms (public-form embeds POST via fetch, not
 *    navigation) may only submit to this origin.
 *  - `frame-ancestors 'self'` — clickjacking protection in the CSP form;
 *    `X-Frame-Options: DENY` is sent as well (belt + suspenders, and for
 *    browsers that predate frame-ancestors support).
 *  - `upgrade-insecure-requests` — NOT set: dev is plain HTTP; production
 *    deployments terminate TLS at the edge and the HSTS there handles
 *    upgrades. (Documented deviation from the "strictest default".)
 *
 * Non-CSP headers (ASVS §7.1–§7.4):
 *  - X-Content-Type-Options: nosniff
 *  - X-Frame-Options: DENY
 *  - Referrer-Policy: no-referrer (the strictest policy that still works;
 *    the app never needs referrer data)
 *  - Permissions-Policy: geolocation=(), microphone=(), camera=() — the
 *    app uses none of these; deny-by-default at the browser level.
 *  - Strict-Transport-Security — production ONLY (plain-HTTP dev would be
 *    broken by HSTS; the edge adds it in prod).
 */

export interface SecurityHeadersOptions {
  /** The API origin (no trailing slash, e.g. `http://localhost:4000`). */
  apiOrigin?: string;
  /** The realtime WebSocket origin (e.g. `ws://localhost:4001`). */
  wsOrigin?: string;
  /** Production flag (controls HSTS). */
  production?: boolean;
}

export type SecurityHeaderMap = Record<string, string>;

/** The web app's Content-Security-Policy (see the directive-by-directive notes above). */
export function webContentSecurityPolicy(opts: SecurityHeadersOptions = {}): string {
  const connect = ["'self'"];
  if (opts.apiOrigin) connect.push(opts.apiOrigin.replace(/\/$/, ""));
  if (opts.wsOrigin) {
    connect.push(opts.wsOrigin.replace(/\/$/, ""));
    // fetch()-based upgrades are not used (the realtime client uses
    // `new WebSocket`), which `connect-src` covers; be explicit regardless.
    const httpWs = opts.wsOrigin
      .replace(/\/$/, "")
      .replace(/^ws:/, "http:")
      .replace(/^wss:/, "https:");
    connect.push(httpWs);
  }
  const scriptSrc = ["'self'", "'unsafe-inline'"];
  // DEV-ONLY 'unsafe-eval': the Next.js 14 dev server emits webpack chunks that
  // embed inline source maps via eval() (180+ eval() calls in main-app.js), so
  // a CSP without 'unsafe-eval' blocks client hydration and the whole app
  // freezes at the SSR "Loading workspace…" spinner (TASK-0135 e2e regression —
  // the TASK-0134 security-audit header change broke every web e2e spec on the
  // dev box). Production builds contain no eval() chunks, so the prod CSP
  // (opts.production) must NOT carry 'unsafe-eval'.
  if (!opts.production) scriptSrc.push("'unsafe-eval'");
  const parts = [
    "default-src 'self'",
    `script-src ${scriptSrc.join(" ")}`,
    `style-src 'self' 'unsafe-inline'`,
    `img-src 'self' data: blob:`,
    `font-src 'self'`,
    `connect-src ${connect.join(" ")}`,
    `frame-src 'self' http: https:`,
    `object-src 'none'`,
    `base-uri 'self'`,
    `form-action 'self'`,
    `frame-ancestors 'self'`
  ];
  return parts.join("; ");
}

/**
 * The full web-app security header map. `next.config.mjs` calls this once
 * (dev values); the security suite calls it with the SAME values and
 * compares the live response, so a drift in either side fails the build.
 */
export function webSecurityHeaders(opts: SecurityHeadersOptions = {}): SecurityHeaderMap {
  const headers: SecurityHeaderMap = {
    "content-security-policy": webContentSecurityPolicy(opts),
    "x-content-type-options": "nosniff",
    "x-frame-options": "DENY",
    "referrer-policy": "no-referrer",
    "permissions-policy": "geolocation=(), microphone=(), camera=()"
  };
  if (opts.production) {
    headers["strict-transport-security"] = "max-age=31536000; includeSubDomains";
  }
  return headers;
}