import { type NextRequest, NextResponse } from "next/server";

/**
 * Proxy (antes "middleware") del panel /admin.
 *
 * 1. Redirección optimista: sin cookie de sesión, /admin/* va al login.
 *    NO autoriza: la validación real de sesión y permisos ocurre en el servidor
 *    (layout del panel, Server Actions y Route Handlers).
 * 2. CSP estricta con nonce por petición para el panel (páginas dinámicas).
 */

const SESSION_COOKIES = ["__Host-chesco_session", "chesco_session"];

function buildAdminCsp(nonce: string): string {
  const isDev = process.env.NODE_ENV !== "production";
  return [
    "default-src 'self'",
    `script-src 'self' 'nonce-${nonce}' 'strict-dynamic'${isDev ? " 'unsafe-eval'" : ""}`,
    // Estilos en línea de React/Next (atributo style) requieren unsafe-inline en estilos.
    "style-src 'self' 'unsafe-inline'",
    "img-src 'self' data: blob: https://res.cloudinary.com",
    "font-src 'self'",
    "connect-src 'self'",
    "object-src 'none'",
    "base-uri 'self'",
    "form-action 'self'",
    "frame-ancestors 'none'",
    ...(isDev ? [] : ["upgrade-insecure-requests"]),
  ].join("; ");
}

export function proxy(request: NextRequest): NextResponse {
  const { pathname, search } = request.nextUrl;
  const isLoginPage = pathname === "/admin/login";
  const hasSessionCookie = SESSION_COOKIES.some((name) => request.cookies.has(name));

  if (!isLoginPage && !hasSessionCookie) {
    const loginUrl = new URL("/admin/login", request.url);
    loginUrl.searchParams.set("next", `${pathname}${search}`);
    return NextResponse.redirect(loginUrl);
  }

  const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
  const csp = buildAdminCsp(nonce);
  const requestHeaders = new Headers(request.headers);
  requestHeaders.set("x-nonce", nonce);
  requestHeaders.set("Content-Security-Policy", csp);

  const response = NextResponse.next({ request: { headers: requestHeaders } });
  response.headers.set("Content-Security-Policy", csp);
  response.headers.set("Cache-Control", "no-store");
  response.headers.set("X-Robots-Tag", "noindex, nofollow");
  return response;
}

export const config = {
  matcher: ["/admin", "/admin/:path*"],
};