// security-headers.js
const helmet = require("helmet");

function configureSecurityHeaders(app) {
  // Comprehensive Helmet configuration
  app.use(
    helmet({
      // Content Security Policy
      contentSecurityPolicy: {
        directives: {
          defaultSrc: ["'self'"],
          scriptSrc: [
            "'self'",
            "'unsafe-inline'", // Remove in production
            "https://cdn.example.com",
            "https://www.google-analytics.com",
          ],
          styleSrc: [
            "'self'",
            "'unsafe-inline'",
            "https://fonts.googleapis.com",
          ],
          fontSrc: ["'self'", "https://fonts.gstatic.com"],
          imgSrc: ["'self'", "data:", "https:", "blob:"],
          connectSrc: ["'self'", "https://api.example.com"],
          frameSrc: ["'none'"],
          objectSrc: ["'none'"],
          upgradeInsecureRequests: [],
        },
      },

      // Strict Transport Security
      hsts: {
        maxAge: 31536000, // 1 year
        includeSubDomains: true,
        preload: true,
      },

      // X-Frame-Options
      frameguard: {
        action: "deny",
      },

      // X-Content-Type-Options
      noSniff: true,

      // X-XSS-Protection
      xssFilter: true,

      // Referrer-Policy
      referrerPolicy: {
        policy: "strict-origin-when-cross-origin",
      },

      // Permissions-Policy (formerly Feature-Policy)
      permittedCrossDomainPolicies: {
        permittedPolicies: "none",
      },
    }),
  );

  // Additional custom headers
  app.use((req, res, next) => {
    // Permissions Policy
    res.setHeader(
      "Permissions-Policy",
      "geolocation=(), microphone=(), camera=(), payment=(), usb=()",
    );

    // Expect-CT
    res.setHeader("Expect-CT", "max-age=86400, enforce");

    // Cross-Origin policies
    res.setHeader("Cross-Origin-Embedder-Policy", "require-corp");
    res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
    res.setHeader("Cross-Origin-Resource-Policy", "same-origin");

    // Remove powered-by header
    res.removeHeader("X-Powered-By");

    next();
  });
}

// CSP Violation Reporter
app.post(
  "/api/csp-report",
  express.json({ type: "application/csp-report" }),
  (req, res) => {
    const report = req.body["csp-report"];

    console.error("CSP Violation:", {
      documentUri: report["document-uri"],
      violatedDirective: report["violated-directive"],
      blockedUri: report["blocked-uri"],
      sourceFile: report["source-file"],
      lineNumber: report["line-number"],
    });

    // Store in database or send to monitoring service
    // monitoringService.logCSPViolation(report);

    res.status(204).end();
  },
);

module.exports = { configureSecurityHeaders };

// test-security-headers.js
const axios = require("axios");

async function testSecurityHeaders(url) {
  console.log(`\n=== Testing Security Headers for ${url} ===\n`);

  try {
    const response = await axios.get(url, {
      validateStatus: () => true,
    });

    const headers = response.headers;

    const tests = {
      "Strict-Transport-Security": {
        present: !!headers["strict-transport-security"],
        value: headers["strict-transport-security"],
        recommended: "max-age=31536000; includeSubDomains; preload",
      },
      "X-Frame-Options": {
        present: !!headers["x-frame-options"],
        value: headers["x-frame-options"],
        recommended: "DENY or SAMEORIGIN",
      },
      "X-Content-Type-Options": {
        present: !!headers["x-content-type-options"],
        value: headers["x-content-type-options"],
        recommended: "nosniff",
      },
      "X-XSS-Protection": {
        present: !!headers["x-xss-protection"],
        value: headers["x-xss-protection"],
        recommended: "1; mode=block",
      },
      "Content-Security-Policy": {
        present: !!headers["content-security-policy"],
        value: headers["content-security-policy"],
        recommended: "Define strict CSP",
      },
      "Referrer-Policy": {
        present: !!headers["referrer-policy"],
        value: headers["referrer-policy"],
        recommended: "strict-origin-when-cross-origin",
      },
      "Permissions-Policy": {
        present: !!headers["permissions-policy"],
        value: headers["permissions-policy"],
        recommended: "Restrict dangerous features",
      },
    };

    let passed = 0;
    let failed = 0;

    for (const [header, test] of Object.entries(tests)) {
      if (test.present) {
        console.log(`✓ ${header}: ${test.value}`);
        passed++;
      } else {
        console.log(`✗ ${header}: MISSING`);
        console.log(`  Recommended: ${test.recommended}`);
        failed++;
      }
    }

    console.log(`\n=== Summary ===`);
    console.log(`Passed: ${passed}/${Object.keys(tests).length}`);
    console.log(`Failed: ${failed}/${Object.keys(tests).length}`);

    const score = (passed / Object.keys(tests).length) * 100;
    console.log(`Security Score: ${score.toFixed(0)}%`);
  } catch (error) {
    console.error("Error testing headers:", error.message);
  }
}

// Usage
testSecurityHeaders("https://example.com");