import { NextRequest, NextResponse } from 'next/server'

function hasExplicitHttpOrigin(): boolean {
  // Allow initial managed setup on a private LAN before the operator claims its
  // origin. The entrypoint owns this flag; it is never derived from the request.
  // Otherwise only an operator-provided origin may opt into HTTP for a private LAN.
  // Never derive this decision from caller-controlled Host/forwarded headers.
  const configured = (process.env.MAGENT_APPLICATION_URL || '').trim()
  if (!configured && process.env.MAGENT_RUNTIME_MANAGED === '1') return true
  if (!/^http:\/\//i.test(configured) || /[\s\\]/.test(configured)) return false
  try {
    const url = new URL(configured)
    return url.protocol === 'http:' && !!url.hostname && !url.username && !url.password
      && url.pathname === '/' && !url.search && !url.hash
  } catch {
    return false
  }
}

export function proxy(request: NextRequest) {
  const nonce = Buffer.from(crypto.randomUUID()).toString('base64')
  const developmentEval = process.env.NODE_ENV === 'development' ? " 'unsafe-eval'" : ''
  const csp = [
    "default-src 'self'",
    "base-uri 'self'",
    "object-src 'none'",
    "frame-ancestors 'none'",
    "form-action 'self'",
    `script-src 'self' 'nonce-${nonce}' 'strict-dynamic'${developmentEval}`,
    "style-src 'self' 'unsafe-inline'",
    "img-src 'self' data: blob: https:",
    "font-src 'self' data:",
    "connect-src 'self'",
    "worker-src 'self' blob:",
    "manifest-src 'self'",
    ...(hasExplicitHttpOrigin() ? [] : ['upgrade-insecure-requests']),
  ].join('; ')

  const requestHeaders = new Headers(request.headers)
  requestHeaders.set('x-nonce', nonce)
  requestHeaders.set('Content-Security-Policy', csp)
  const response = NextResponse.next({ request: { headers: requestHeaders } })
  response.headers.set('Content-Security-Policy', csp)
  return response
}

export const config = {
  matcher: [
    {
      source: '/((?!api|_next/static|_next/image|favicon.ico|branding/).*)',
      missing: [
        { type: 'header', key: 'next-router-prefetch' },
        { type: 'header', key: 'purpose', value: 'prefetch' },
      ],
    },
  ],
}