from starlette.middleware.base import BaseHTTPMiddleware
from starlette.requests import Request
from starlette.responses import Response

DOCS_PATHS = ("/docs", "/redoc", "/openapi.json")

# CSP básica para el resto del sitio.
DEFAULT_CSP = (
    "default-src 'self'; "
    "img-src 'self' data: https:; "
    "style-src 'self' 'unsafe-inline'; "
    "script-src 'self'; "
    "connect-src 'self' https: http:; "
    "frame-ancestors 'none';"
)

# Swagger UI / ReDoc cargan su JS y CSS desde cdn.jsdelivr.net.
DOCS_CSP = (
    "default-src 'self'; "
    "img-src 'self' data: https:; "
    "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
    "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
    "connect-src 'self' https: http:; "
    "frame-ancestors 'none';"
)

class SecurityHeadersMiddleware(BaseHTTPMiddleware):
    async def dispatch(self, request:Request, call_next):
        resp:Response = await call_next(request)

        # Headers seguros (ajustables según tus necesidades)
        resp.headers["X-Content-Type-Options"] = "nosniff"
        resp.headers["X-Frame-Options"] = "DENY"
        resp.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
        resp.headers["Permissions-Policy"] = "geolocation=(), microphone=(), camera=()"
        resp.headers["Content-Security-Policy"] = (
            DOCS_CSP if request.url.path.startswith(DOCS_PATHS) else DEFAULT_CSP
        )
        return resp