<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;
use Illuminate\Support\Facades\View;
use Illuminate\Support\Facades\Vite;
use Symfony\Component\HttpFoundation\Response;

class SecureHeaders
{
    private $unwantedHeaderList = [
        'X-Powered-By',
        'Server',
    ];

    public function handle(Request $request, Closure $next): Response
    {
        // * For Vite DEV
        $host = \parse_url((string) \config('app.url'), \PHP_URL_HOST);

        $viteDevOrigin = config('app.debug') && \is_string($host) && $host !== '' ? "https://{$host}:4443" : null;
        $viteDevSocket = config('app.debug') && \is_string($host) && $host !== '' ? "wss://{$host}:4443" : null;

        View::share('nonce', $nonce = Vite::useCspNonce());

        // * For VueJS dev tool to execute
        $jsDev     = config('app.debug') ? "'unsafe-eval' 'unsafe-inline'" : "'nonce-{$nonce}' 'strict-dynamic'";
        $scheme    = config('app.env') === 'local' ? 'http' : 'https';
        $reportUri = Route::has('cspReportUri') ? \sprintf(' report-uri %s ;', \parse_url(route('cspReportUri'), \PHP_URL_PATH)) : '';

        $this->removeUnwantedHeaders($this->unwantedHeaderList);
        $response = $next($request);

        $response->headers->set('Referrer-Policy', 'no-referrer-when-downgrade');
        $response->headers->set('X-Content-Type-Options', 'nosniff');
        $response->headers->set('X-XSS-Protection', '1; mode=block');
        $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
        $response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains;');

        // Utilisation de array_filter pour ne pas inclure les valeurs null en production
        $cspPolicies = [
            "default-src 'none';",
            "manifest-src 'self';",
            "connect-src 'self' blob: " . implode(' ', array_filter([
                $viteDevSocket,
                $viteDevOrigin,
                'https://yl.s-web.fr'
            ])) . ';',
            "img-src 'self' data: blob: " . implode(' ', array_filter([
                $viteDevOrigin,
            ])) . ';',
            "object-src 'self';",
            "frame-src 'self' " . implode(' ', [
                'https://www.google.com/recaptcha/',
                'https://recaptcha.google.com/recaptcha/',
                'https://www.google.com/maps/'
            ]) . ';',
            "font-src 'self' data: " . implode(' ', array_filter([
                $viteDevOrigin,
                'https://fonts.gstatic.com' // <-- Point-virgule retiré ici
            ])) . ';',
            "style-src 'self' 'unsafe-inline' " . implode(' ', array_filter([
                'https://cdnjs.cloudflare.com',
                'https://fonts.googleapis.com',
                'https://cdn.jsdelivr.net',
                'https://use.fontawesome.com',
                $viteDevOrigin,
            ])) . ';',
            "script-src 'self' {$jsDev} " . implode(' ', array_filter([
                'https:',
                'blob:',
                'https://www.googletagmanager.com',
                'https://cdnjs.cloudflare.com',
                "$scheme://www.google-analytics.com",
                $viteDevOrigin,
            ])) . ';'
        ];

        $response->headers->set(
            'Content-Security-Policy',
            implode(' ', $cspPolicies) . $reportUri
        );
        $response->headers->set('Feature-Policy', 'fullscreen \'self\';');

        return $response;
    }

    private function removeUnwantedHeaders(array $headerList): void
    {
        foreach ($headerList as $header) {
            header_remove($header);
        }
    }
}