import { dev } from "$app/environment";
import { type Handle } from "@sveltejs/kit";

/**
 * SvelteKit server hook that handles security headers (CSP, X-Frame-Options, HSTS, etc.)
 *
 * @param {Object} params - Hook parameters
 * @param {import('@sveltejs/kit').RequestEvent} params.event - The request event
 * @param {Function} params.resolve - Function to resolve the request
 * @returns {Promise<Response>} The response with applied headers and rate limiting
 */
export const secHeaderHandle: Handle = async ({ event, resolve }) => {
  const response = await resolve(event);

  // TODO: These has to be rechecked and coordinated with caddy's configuration
  response.headers.set("X-Frame-Options", "DENY");
  response.headers.set("X-Content-Type-Options", "nosniff");
  response.headers.set("X-XSS-Protection", "1; mode=block");
  response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
  response.headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=()");

  if (event.url.protocol === "https:") {
    response.headers.set(
      "Strict-Transport-Security",
      "max-age=31536000; includeSubDomains; preload",
    );
  }

  const cspDirectives = [
    "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://unpkg.com", // Allow inline scripts, WASM modules, and unpkg CDN (for Swagger)
    "style-src 'self' 'unsafe-inline' https://unpkg.com",
    "font-src 'self' data: https://unpkg.com",
    "connect-src 'self'",
    "media-src 'self'",
    "object-src 'none'",
    "base-uri 'self'",
    "form-action 'self'",
    "frame-ancestors 'none'",
    "upgrade-insecure-requests",
  ];
  if (!dev) {
    cspDirectives.unshift("default-src 'self' 'wasm-unsafe-eval'");
    cspDirectives.push("img-src 'self' data: https:");
  }
  response.headers.set("Content-Security-Policy", cspDirectives.join("; "));

  if (event.url.pathname.startsWith("/api/")) {
    response.headers.set("Access-Control-Allow-Origin", "*"); // TODO: Should be limited to own server and registered webhooks etc.
    response.headers.set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, PATCH, OPTIONS");
    response.headers.set(
      "Access-Control-Allow-Headers",
      "Content-Type, Authorization, X-Requested-With",
    );
  }
  return response;
};
