<?php

namespace App\Http\Middleware;

use App\Support\ContentSecurityPolicy;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

/**
 * Applikationsseitige Security-Header (R6.2) — bewusst unabhängig vom
 * Reverse-Proxy gesetzt, damit der Schutz auch bei Proxy-Wechsel bleibt.
 * Bereits vorhandene Header (z. B. vom Proxy) werden nicht überschrieben.
 * HSTS nur auf HTTPS-Antworten und laut config/security.php.
 * CSP vorerst nur im Melde-Modus (ContentSecurityPolicy, config/security.php).
 */
class SecurityHeaders
{
    public function handle(Request $request, Closure $next): Response
    {
        $response = $next($request);

        foreach ([
            'X-Content-Type-Options' => 'nosniff',
            'X-Frame-Options' => 'SAMEORIGIN',
            'Referrer-Policy' => 'strict-origin-when-cross-origin',
            'Permissions-Policy' => 'camera=(), microphone=(), geolocation=()',
        ] as $header => $value) {
            if (! $response->headers->has($header)) {
                $response->headers->set($header, $value);
            }
        }

        if (config('security.csp.report_only')
            && str_contains((string) $response->headers->get('Content-Type'), 'text/html')
            && ! $response->headers->has('Content-Security-Policy-Report-Only')) {
            $response->headers->set('Content-Security-Policy-Report-Only', ContentSecurityPolicy::header());
        }

        if ($request->isSecure() && config('security.hsts.enabled') && ! $response->headers->has('Strict-Transport-Security')) {
            $response->headers->set('Strict-Transport-Security', 'max-age='.(int) config('security.hsts.max_age'));
        }

        return $response;
    }
}