<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;
use Illuminate\Support\Facades\View;

class SecureHeaders
{
    /**
     * Enumerate headers which you do not want in your application's responses.
     * Great starting point would be to go check out @Scott_Helme's:
     * https://securityheaders.com/
     *
     * @var array
     */
    private $unwantedHeaderList = [
        'X-Powered-By',
        'Server',
    ];

    /**
     * Handle an incoming request.
     *
     * @param \Illuminate\Http\Request $request
     * @param \Closure                 $next
     * @return \Symfony\Component\HttpFoundation\Response
     */
    public function handle(Request $request, Closure $next): \Symfony\Component\HttpFoundation\Response
    {
        // phpcs:enable
        View::share('nonce', $nonce = \uniqid());
        // * For VueJS dev tool to execute
        $jsDev     = config('app.debug') ? "'unsafe-eval' 'unsafe-inline'" : "'nonce-{$nonce}' 'strict-dynamic'";
        $reportUri = Route::has('cspReportUri') ?
            \sprintf('report-uri %s', \parse_url(route('cspReportUri'), \PHP_URL_PATH)) : '';
        $this->removeUnwantedHeaders($this->unwantedHeaderList);
        $response = $next($request);
        $response->headers->set('Referrer-Policy', 'no-referrer-when-downgrade');
        $response->headers->set('X-Content-Type-Options', 'nosniff');
        $response->headers->set('X-XSS-Protection', '1; mode=block');
        $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
        $response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains;');
        $cspPolicies = [
            "default-src 'none';",
            "manifest-src 'self';",
            "connect-src " . \implode(' ', [
                // * VIMEO
                'https://player.vimeo.com',
                // * MATOMO
                'https://yl.s-web.fr',
                // * RECAPTCHA
                'https://www.google.com/recaptcha/',
                'https://recaptcha.google.com/recaptcha/',
                // * OTHERS
                'blob:',
                '\'self\'',
            ]) . ';',
            'img-src ' . implode(" ", [
                // * MATOMO
                'https://yl.s-web.fr',
                // * OTHERS
                '*',
                'blob:',
                'data:',
            ]) . ';',
            "frame-src  " . implode(" ", [
                // * VIMEO
                'https://player.vimeo.com',
                // * RECAPTCHA
                'https://www.google.com/recaptcha/',
                'https://recaptcha.google.com/recaptcha/',
                '\'self\'',
            ]) . ';',
            'font-src ' . implode(" ", [
                // * OTHERS
                '\'self\'',
                'data:',
            ]) . ';',
            'style-src ' . implode(" ", [
                // * CKEDITOR
                '\'unsafe-inline\'',
                // * OTHERS
                '\'self\'',
            ]) . ';',
            'script-src ' . implode(" ", [
                // * MATOMO
                'https://yl.s-web.fr',
                // * RECAPTCHA
                'https://www.google.com/recaptcha/',
                'https://www.gstatic.com/recaptcha/',
                // * OTHERS
                '\'self\'',
                '\'unsafe-eval\'',
            ]) . ' ' . $jsDev . ';'
        ];
        $response->headers->set(
            'Content-Security-Policy',
            implode(' ', $cspPolicies) . $reportUri
        );
        $response->headers->set('Feature-Policy', 'fullscreen \'self\';');
        return $response;
    }

    /**
     * Remove unwanted headers.
     *
     * @param array $headerList
     * @return void
     */
    private function removeUnwantedHeaders(array $headerList): void
    {
        foreach ($headerList as $header) {
            header_remove($header);
        }
    }
}