# ERB templated nginx configuration
# see https://doc.scalingo.com/platform/deployment/buildpacks/nginx

upstream backend_server {
	server localhost:8000 fail_timeout=0;
}

server {
	
	listen <%= ENV["PORT"] %>;
	server_name _;

    root /app/build/frontend-out;
    
    error_page 404 /404.html;

    # Django rest framework and external API
    location ~ ^/(api|external_api)/ {
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_redirect off;
        proxy_pass http://backend_server;
    }

    # Django admin
    location ^~ /admin/ {
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_redirect off;
		proxy_pass http://backend_server;
	}

    # Proxy auth for media
    location /media/ {
        # Auth request configuration
        auth_request /media-auth;
        auth_request_set $authHeader $upstream_http_authorization;
        auth_request_set $authDate $upstream_http_x_amz_date;
        auth_request_set $authContentSha256 $upstream_http_x_amz_content_sha256;

        # Pass specific headers from the auth response
        proxy_set_header Authorization $authHeader;
        proxy_set_header X-Amz-Date $authDate;
        proxy_set_header X-Amz-Content-SHA256 $authContentSha256;

        # Get resource from Object Storage
        proxy_pass <%= ENV["AWS_S3_BUCKET_INTERNAL_URL"] %>;
        proxy_set_header Host <%= ENV["AWS_S3_BUCKET_INTERNAL_HOST"] %>;
        add_header Content-Security-Policy "default-src 'none'" always;
        add_header Content-Disposition "attachment";
    }

    location /media/preview/ {
        # Auth request configuration
        auth_request /media-auth;
        auth_request_set $authHeader $upstream_http_authorization;
        auth_request_set $authDate $upstream_http_x_amz_date;
        auth_request_set $authContentSha256 $upstream_http_x_amz_content_sha256;

        # Pass specific headers from the auth response
        proxy_set_header Authorization $authHeader;
        proxy_set_header X-Amz-Date $authDate;
        proxy_set_header X-Amz-Content-SHA256 $authContentSha256;

        # Get resource from Object Storage
        proxy_pass <%= ENV["AWS_S3_BUCKET_INTERNAL_URL"] %>;
        proxy_set_header Host <%= ENV["AWS_S3_BUCKET_INTERNAL_HOST"] %>;
        add_header Content-Security-Policy "default-src 'none'" always;
    }

    location /media-auth {
        proxy_pass http://backend_server/api/v1.0/items/media-auth/;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Original-URL $request_uri;

        # Prevent the body from being passed
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Original-Method $request_method;
    }

    location ~ "^/explorer/items/files/[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/?$" {
        try_files $uri /explorer/items/files/[id].html;
    }

    location ~ "^/explorer/items/[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/?$" {
        try_files $uri /explorer/items/[id].html;
    }

    location ~ "^/wopi/[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/?$" {
        try_files $uri /wopi/[id].html;
    }    

    location ~ "^/explorer/items/(favorites|my-files|recent|shared-with-me)/?$" {
        try_files $uri /explorer/items/$1.html;
    }

    location ~ "^/sdk/explorer/?$" {
        try_files $uri /sdk/explorer.html;
    }

    location ~ "^/sdk/?$" {
        try_files $uri /sdk.html;
    }

    location ~ "^/explorer/trash/?$" {
        try_files $uri /explorer/trash.html;
    }

    location ~ "^/401/?$" {
        try_files $uri /401.html;
    }

    location ~ "^/403/?$" {
        try_files $uri /403.html;
    }
    
    location = /404.html {
        internal;
    }

    # Fix .mjs MIME type for Scalingo's Alpine-based nginx
    # Alpine's default mime.types lacks .mjs, causing pdf.worker.mjs
    # to be served as application/octet-stream which breaks ES modules
    location ~* \.mjs$ {
        types { application/javascript mjs; }
        try_files $uri =404;
    }

    # Frontend export
    location / {
        try_files $uri index.html $uri/ =404;
    }

}
