import type { MiddlewareHandler } from 'hono'

/**
 * Global security headers middleware.
 * Generates a per-request nonce for CSP script-src.
 * Must run before route handlers.
 */
export const securityHeadersMiddleware: MiddlewareHandler = async (c, next) => {
  // Generate a fresh 16-byte base64url nonce per request
  const nonceBytes = new Uint8Array(16)
  crypto.getRandomValues(nonceBytes)
  const nonce = btoa(String.fromCharCode(...nonceBytes))
    .replace(/\+/g, '-')
    .replace(/\//g, '_')
    .replace(/=/g, '')

  // Expose nonce on context for inline <script nonce> tags
  c.set('nonce', nonce)

  c.header('X-Content-Type-Options', 'nosniff')
  c.header('X-Frame-Options', 'DENY')
  c.header('Referrer-Policy', 'strict-origin-when-cross-origin')
  c.header('Permissions-Policy', 'geolocation=(), camera=(), microphone=()')
  c.header('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload')
  c.header(
    'Content-Security-Policy',
    [
      "default-src 'self'",
      `script-src 'self' 'nonce-${nonce}'`,
      "connect-src 'self' https://api.zync.is wss://api.zync.is https://*.firebaseapp.com https://firebasestorage.googleapis.com",
      "img-src 'self' data: https://*.r2.dev",
      "font-src 'self' https://*.r2.dev",
      "frame-ancestors 'none'",
      "base-uri 'self'",
      "form-action 'self'",
    ].join('; ')
  )

  await next()
}