// app/Middleware/HelmetSecurity.ts
import type { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'
import helmet from 'helmet'

export default class HelmetSecurity {
  public async handle({ response }: HttpContextContract, next: () => Promise<void>) {
    // 🧭 Deja que Adonis cree la respuesta primero
    await next()

    // 🪖 Aplica Helmet una vez que el objeto response existe
    helmet({
      hidePoweredBy: true,
      frameguard: { action: 'deny' },
      referrerPolicy: { policy: 'no-referrer' },
      contentSecurityPolicy: false, // desactiva si usas recursos externos
    })(response.request, response.response, () => {})
  }
}