import { NextResponse } from "next/server";

export function middleware(request) {
    const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
    const cspHeader =
        `
        default-src 'self';
        script-src 'self' 'nonce-${nonce}' 'strict-dynamic' https: http: ${
            process.env.NODE_ENV === "production" ? "" : `'unsafe-eval'`
        };
        style-src 'self' 'unsafe-eval' 'unsafe-inline';
        img-src 'self' 'unsafe-inline'  https://datamap.gov.wales/ https://mapdata.llyw.cymru/ https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com  blob: data: https://img.youtube.com;
        connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;
        font-src 'self'  https://pro.fontawesome.com/ https://fonts.gstatic.com/ ;
        object-src 'none';
        base-uri 'self';
        frame-src https://datamap.gov.wales/ https://mapdata.llyw.cymru/ https://www.youtube.com https://www.youtube-nocookie.com;
        form-action 'self' ` +
        process.env.NEXTAUTH_URL +
        `;
        frame-ancestors 'none';
        upgrade-insecure-requests;
    `;

    //const cspHeader = "";

    // csp += `base-uri 'self';`;
    // csp += `script-src 'self' 'unsafe-eval' 'unsafe-inline' https://ukwest-0.in.applicationinsights.azure.com https://region1.google-analytics.com https://www.google-analytics.com/ https://tagmanager.google.com/ https://www.googletagmanager.com/;`;
    // csp += `style-src 'self' 'unsafe-inline' https://pro.fontawesome.com/ https://www.google-analytics.com https://tagmanager.google.com/ https://www.googletagmanager.com/ https://fonts.googleapis.com/;`;
    // csp += `img-src 'self' 'unsafe-inline' https://maps.gstatic.com  https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://ssl.gstatic.com/  blob: data:;`;
    // csp += `connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;`;

    // csp += `form-action 'self' ` + process.env.NEXTAUTH_URL + ` ;`;
    // csp += `object-src 'self' data:;`;
    // csp += `default-src 'self' https://www.google-analytics.com;`;

    // csp += `font-src 'self' 'unsafe-inline' https://pro.fontawesome.com/ https://fonts.gstatic.com/ data:;`;
    // csp += `frame-src https://datamap.gov.wales`;

    // Replace newline characters and spaces
    const contentSecurityPolicyHeaderValue = cspHeader
        .replace(/\s{2,}/g, " ")
        .trim();

    const requestHeaders = new Headers(request.headers);
    // Unique trusted nonce
    requestHeaders.set("x-nonce", nonce);

    // CSP policy
    requestHeaders.set(
        "Content-Security-Policy",
        contentSecurityPolicyHeaderValue
    );

    const response = NextResponse.next({
        request: {
            headers: requestHeaders
        }
    });
    response.headers.set(
        "Content-Security-Policy",
        contentSecurityPolicyHeaderValue
    );

    // XSS protection (legacy)
    response.headers.set("X-XSS-Protection", "1; mode=block");

    // Prevent MIME type sniffing
    response.headers.set("X-Content-Type-Options", "nosniff");

    // Prevent iframe embedding
    response.headers.set("X-Frame-Options", "DENY");

    // Referrer policy
    response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");

    // Permissions lockdown
    response.headers.set(
        "Permissions-Policy",
        "geolocation=(), camera=(), microphone=(), fullscreen=(self)"
    );

    // Enforce HTTPS via HSTS
    response.headers.set(
        "Strict-Transport-Security",
        "max-age=63072000; includeSubDomains; preload"
    );

    return response;
}