// @ts-nocheck
import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'

export default class SecurityHeaders {
  public async handle({ response, request }: HttpContextContract, next: () => Promise<void>) {
    const isDev = process.env.NODE_ENV !== 'production'
    const nonce = this.generateNonce()

    // 🔒 Solo permitir ciertos métodos HTTP
    const allowedMethods = ['GET', 'POST', 'HEAD', 'OPTIONS']
    if (!allowedMethods.includes(request.method())) {
      return response.status(405).send('Method Not Allowed')
    }

    /**
     * 🧱 Cabeceras generales de seguridad
     */
    response.header('X-Frame-Options', 'SAMEORIGIN')
    response.header('X-Content-Type-Options', 'nosniff')
    response.header('Referrer-Policy', 'strict-origin-when-cross-origin')
    response.header('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), fullscreen=(self), payment=()')
    response.header('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0')
    response.header('Pragma', 'no-cache')
    response.response?.removeHeader?.('X-Powered-By')

    // HSTS solo en producción
    if (!isDev) {
      response.header('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload')
    }

    /**
     * 🧠 Content Security Policy (CSP)
     * Ajustada para permitir:
     * - Google reCAPTCHA
     * - Genesys Cloud
     * - Videos e imágenes desde admin.relianz.com.co
     * - Recursos locales (127.0.0.1:9999) en modo desarrollo
     */
    const cspDirectives = [
      `default-src 'self'`,
      `base-uri 'self'`,
      `form-action 'self'`,
      `object-src 'none'`,
      `font-src 'self' https://fonts.gstatic.com`,
      `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com`,
      `script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://www.google.com https://www.gstatic.com https://www.recaptcha.net https://www.googletagmanager.com https://apps.usw2.pure.cloud${isDev ? " http://127.0.0.1:9999" : ''}`,
      `img-src 'self' data: blob: https://admin.relianz.com.co https://adminrelianz.gutand.com https://relianzisadmin.gutand.co https://s7d2.scene7.com *.cdninstagram.com`,
      `media-src 'self' blob: https://admin.relianz.com.co`,
      `connect-src 'self' https://www.google.com https://www.gstatic.com https://www.recaptcha.net https://apps.usw2.pure.cloud https://api.usw2.pure.cloud https://api-cdn.usw2.pure.cloud wss://webmessaging.usw2.pure.cloud${isDev ? " http://127.0.0.1:9999 ws://127.0.0.1:9999" : ''}`,
      `frame-src 'self' https://www.google.com https://www.recaptcha.net https://www.gstatic.com https://apps.usw2.pure.cloud https://www.youtube.com`,
      `frame-ancestors 'self'`,
      `upgrade-insecure-requests`,
    ]

    response.header('Content-Security-Policy', cspDirectives.join('; '))
    request.nonce = nonce

    await next()
  }

  private generateNonce() {
    return Math.random().toString(36).slice(2)
  }
}