package httpx

import "net/http"

// ContentSecurityPolicy is the strict default CSP (SPEC-003 §4). It allows only
// same-origin assets; the PWA manifest and service worker are same-origin too.
const ContentSecurityPolicy = "default-src 'self'; " +
	"img-src 'self' data:; " +
	"style-src 'self'; " +
	"script-src 'self'; " +
	"connect-src 'self'; " +
	"object-src 'none'; " +
	"base-uri 'none'; " +
	"form-action 'self'; " +
	"frame-ancestors 'none'"

// SetSecurityHeaders writes the baseline security headers on every response
// (SPEC-003 §4). HSTS is set only when the app is served over https (secure).
func SetSecurityHeaders(w http.ResponseWriter, secure bool) {
	h := w.Header()
	h.Set("X-Content-Type-Options", "nosniff")
	h.Set("Referrer-Policy", "no-referrer")
	h.Set("X-Frame-Options", "DENY")
	h.Set("Content-Security-Policy", ContentSecurityPolicy)
	if secure {
		h.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
	}
}