/**
 * Sicherheits-Header, eingehängt in next.config.ts.
 *
 * Content-Security-Policy ist der zentrale Querschnitts-Schutz (Implementierungs-
 * plan Z.1314): in Produktion strikt mit default-src 'self', frame-ancestors 'none'
 * und form-action 'self'. Im Dev-Modus benötigt Next.js (HMR/React-Refresh) eine
 * gelockerte script-src/connect-src-Variante ('unsafe-eval' + ws: für den Dev-Socket).
 */
const isProd = process.env.NODE_ENV === "production";

const CSP = [
  "default-src 'self'",
  // Dev braucht eval (React Refresh) + inline; Prod bleibt strikt.
  isProd
    ? "script-src 'self'"
    : "script-src 'self' 'unsafe-eval' 'unsafe-inline'",
  "style-src 'self' 'unsafe-inline'",
  "img-src 'self' data: blob:",
  "font-src 'self' data:",
  "worker-src 'self' blob:",
  // Dev: WebSocket für HMR erlauben.
  isProd ? "connect-src 'self'" : "connect-src 'self' ws: wss:",
  "frame-ancestors 'none'",
  "form-action 'self'",
  "base-uri 'self'",
  "object-src 'none'",
].join("; ");

export const SECURITY_HEADERS: Record<string, string> = {
  "Content-Security-Policy": CSP,
  "X-Content-Type-Options": "nosniff",
  "X-Frame-Options": "DENY",
  "Referrer-Policy": "strict-origin-when-cross-origin",
  "Permissions-Policy": "geolocation=(self), camera=(), microphone=()",
  "Strict-Transport-Security": "max-age=63072000; includeSubDomains; preload",
  "X-DNS-Prefetch-Control": "off",
};
