defmodule ToweropsWeb.Plugs.SecurityHeaders do
  @moduledoc """
  Adds security headers to all responses.

  Headers added:
  - Content-Security-Policy: Restricts resource loading to prevent XSS
  - X-Frame-Options: Prevents clickjacking attacks
  - X-Content-Type-Options: Prevents MIME type sniffing
  - Referrer-Policy: Controls referrer information leakage
  - Permissions-Policy: Disables browsing-topics API
  """

  import Plug.Conn

  def init(opts), do: opts

  def call(conn, _opts) do
    conn
    |> put_resp_header("permissions-policy", "browsing-topics=()")
    |> put_resp_header("content-security-policy", csp_header())
    |> put_resp_header("x-frame-options", "DENY")
    |> put_resp_header("x-content-type-options", "nosniff")
    |> put_resp_header("referrer-policy", "strict-origin-when-cross-origin")
  end

  defp csp_header do
    Enum.join(
      [
        "default-src 'self' data:",
        "script-src 'self' 'unsafe-inline' https://a.w5isp.com",
        "style-src 'self' 'unsafe-inline' 'unsafe-hashes'",
        "img-src 'self' data: https:",
        "font-src 'self' data:",
        "connect-src 'self' ws: wss: https://a.w5isp.com",
        "frame-ancestors 'none'"
      ],
      "; "
    )
  end
end