#ifndef THIRD_PARTY_GBMCWEB_INCLUDE_SECURITY_HEADERS_H_
#define THIRD_PARTY_GBMCWEB_INCLUDE_SECURITY_HEADERS_H_

#include <string_view>

#include "bmcweb_config.h"
#include "http_request.hpp"
#include "http_response.hpp"

inline void addSecurityHeaders(const crow::Request& req [[maybe_unused]],
                               crow::Response& res) {
  /*
   TODO(ed) these should really check content types.  for example,
   X-UA-Compatible header doesn't make sense when retrieving a JSON or
   javascript file.  It doesn't hurt anything, it's just ugly.
   */
  using bf = boost::beast::http::field;
  res.addHeader(bf::strict_transport_security,
                "max-age=31536000; "
                "includeSubdomains; "
                "preload");
  res.addHeader(bf::x_frame_options, "DENY");

  res.addHeader(bf::pragma, "no-cache");
  res.addHeader(bf::cache_control, "no-Store,no-Cache");

  res.addHeader("X-XSS-Protection",
                "1; "
                "mode=block");
  res.addHeader("X-Content-Type-Options", "nosniff");

  if (bmcwebInsecureDisableXssPrevention == 0) {
    res.addHeader("Content-Security-Policy",
                  "default-src 'none'; "
                  "img-src 'self' data:; "
                  "font-src 'self'; "
                  "style-src 'self'; "
                  "script-src 'self'; "
                  "connect-src 'self' wss:; "
                  "form-action 'none'; "
                  "frame-ancestors 'none'; "
                  "object-src 'none'; "
                  "base-uri 'none' ");
    // The KVM currently needs to load images from base64 encoded
    // strings. img-src 'self' data: is used to allow that.
    // https://stackoverflow.com/questions/18447970/content-security-polic
    // y-data-not-working-for-base64-images-in-chrome-28
  } else {
    // If XSS is disabled, we need to allow loading from addresses other
    // than self, as the BMC will be hosted elsewhere.
    res.addHeader("Content-Security-Policy",
                  "default-src 'none'; "
                  "img-src *; "
                  "font-src *; "
                  "style-src *; "
                  "script-src *; "
                  "connect-src *; "
                  "form-action *; "
                  "frame-ancestors *; "
                  "object-src *; "
                  "base-uri *");

    std::string_view origin = req.getHeaderValue("Origin");
    res.addHeader(bf::access_control_allow_origin, origin);
    res.addHeader(bf::access_control_allow_methods,
                  "GET, "
                  "POST, "
                  "PUT, "
                  "PATCH, "
                  "DELETE");
    res.addHeader(bf::access_control_allow_credentials, "true");
    res.addHeader(bf::access_control_allow_headers,
                  "Origin, "
                  "Content-Type, "
                  "Accept, "
                  "Cookie, "
                  "X-XSRF-TOKEN");
  }
}

#endif  // THIRD_PARTY_GBMCWEB_INCLUDE_SECURITY_HEADERS_H_