import type { MiddlewareHandler } from 'hono';
import { cors as honoCors } from 'hono/cors';

function getWebOrigin(): string {
  return process.env.WEB_URL ?? 'http://localhost:6173';
}

export const corsMiddleware: MiddlewareHandler = honoCors({
  origin: (requestOrigin) => {
    const allowed = getWebOrigin();
    if (requestOrigin === allowed) {
      return requestOrigin;
    }
    return '';
  },
  allowMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
  allowHeaders: ['Content-Type', 'Authorization', 'Cache-Control'],
  maxAge: 600,
  credentials: true,
});

export const securityHeadersMiddleware: MiddlewareHandler = async (c, next) => {
  await next();

  c.header('X-Content-Type-Options', 'nosniff');
  c.header('X-Frame-Options', 'DENY');
  c.header('X-XSS-Protection', '0');
  c.header('Referrer-Policy', 'strict-origin-when-cross-origin');
  c.header('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');

  if (process.env.NODE_ENV === 'production') {
    c.header('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
  }
};