/** @type {import('next').NextConfig} */

// Content-Security-Policy.
//
// `script-src` and `style-src` keep `'unsafe-inline'` because Next.js
// emits inline bootstrap scripts and Tailwind injects critical inline
// `<style>`. We tried nonce-based CSP via middleware in v1.0.0:1 and
// it produced a blank-screen first paint in production — the bootstrap
// scripts weren't picking up the nonce reliably. Reverted in v1.0.0:2.
// The directives we DO get for free here still cut off common XSS
// followups:
//   - frame-ancestors 'none'  -> can't be embedded anywhere
//   - base-uri 'self'         -> attacker can't pivot relative URLs
//   - form-action 'self'      -> stolen forms can't POST credentials
//   - object-src 'none'       -> no Flash/Java applets, full stop
//   - default-src 'self'      -> images/fetches/etc default same-origin
const csp = [
  "default-src 'self'",
  "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
  "style-src 'self' 'unsafe-inline'",
  "img-src 'self' data: blob:",
  "font-src 'self' data:",
  "connect-src 'self'",
  "frame-ancestors 'none'",
  "base-uri 'self'",
  "form-action 'self'",
  "object-src 'none'",
].join('; ');

const securityHeaders = [
  { key: 'Content-Security-Policy', value: csp },
  // HSTS: tell browsers to use HTTPS only for this origin for a year.
  // StartOS terminates TLS in front of the container, so this applies
  // to the public hostname users actually visit.
  {
    key: 'Strict-Transport-Security',
    value: 'max-age=31536000; includeSubDomains',
  },
  { key: 'X-Content-Type-Options', value: 'nosniff' },
  { key: 'X-Frame-Options', value: 'DENY' },
  // Don't leak the full URL (which can include exercise IDs, workout
  // IDs, etc.) when the user clicks a third-party link.
  { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
  // Block every browser API we don't actually use. If we ever add
  // camera/mic/geo features, allow-list them here explicitly.
  {
    key: 'Permissions-Policy',
    value:
      'accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()',
  },
];

const nextConfig = {
  reactStrictMode: true,
  output: 'standalone',
  images: {
    unoptimized: false,
  },
  headers: async () => [
    {
      source: '/(.*)',
      headers: securityHeaders,
    },
  ],
};

module.exports = nextConfig;
