import { NextResponse } from "next/server";

export function middleware(request) {
    const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
    const cspHeader = `
    default-src 'self';
    script-src 'self' 'nonce-${nonce}' 'strict-dynamic' https: http: ${
        process.env.NODE_ENV === "production" ? "" : `'unsafe-eval'`
    };
    style-src 'self' 'unsafe-eval' 'unsafe-inline';
    img-src 'self' blob: data:;
    connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;
    font-src 'self'  https://pro.fontawesome.com/ https://fonts.gstatic.com/ ;
    object-src 'none';
    base-uri 'self';
    form-action 'self' ${process.env.NEXTAUTH_URL}; 
    frame-ancestors 'none';
    upgrade-insecure-requests;
    frame-src https://datamap.gov.wales;
`;

    // csp += `base-uri 'self';`;
    // csp += `script-src 'self' 'unsafe-eval' 'unsafe-inline' https://ukwest-0.in.applicationinsights.azure.com https://region1.google-analytics.com https://www.google-analytics.com/ https://tagmanager.google.com/ https://www.googletagmanager.com/;`;
    // csp += `style-src 'self' 'unsafe-inline' https://pro.fontawesome.com/ https://www.google-analytics.com https://tagmanager.google.com/ https://www.googletagmanager.com/ https://fonts.googleapis.com/;`;
    // csp += `img-src 'self' 'unsafe-inline' https://maps.gstatic.com  https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://ssl.gstatic.com/  blob: data:;`;
    // csp += `connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;`;

    // csp += `form-action 'self' ` + process.env.NEXTAUTH_URL + ` ;`;
    // csp += `object-src 'self' data:;`;
    // csp += `default-src 'self' https://www.google-analytics.com;`;

    // csp += `font-src 'self' 'unsafe-inline' https://pro.fontawesome.com/ https://fonts.gstatic.com/ data:;`;
    // csp += `frame-src https://datamap.gov.wales`;

    // Replace newline characters and spaces
    const contentSecurityPolicyHeaderValue = cspHeader
        .replace(/\s{2,}/g, " ")
        .trim();

    const requestHeaders = new Headers(request.headers);
    requestHeaders.set("x-nonce", nonce);
    requestHeaders.set(
        "Content-Security-Policy",
        contentSecurityPolicyHeaderValue
    );

    const response = NextResponse.next({
        request: {
            headers: requestHeaders,
        },
    });
    response.headers.set(
        "Content-Security-Policy",
        contentSecurityPolicyHeaderValue
    );

    return response;
}

export const config = {
    matcher: [
        /*
         * Match all request paths except for the ones starting with:
         * - api (API routes)
         * - _next/static (static files)
         * - _next/image (image optimization files)
         * - favicon.ico (favicon file)
         */
        {
            source: "/((?!api|_next/static|_next/image|favicon.ico).*)",
            missing: [
                { type: "header", key: "next-router-prefetch" },
                { type: "header", key: "purpose", value: "prefetch" },
            ],
        },
    ],
};