const LOCAL_HEALTH_ADDRESSES = new Set([
  '127.0.0.1',
  '::1',
  '::ffff:127.0.0.1'
]);

function applySecurityHeaders(req, res, options = {}) {
  res.setHeader('X-Frame-Options', 'SAMEORIGIN');
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('X-XSS-Protection', '1; mode=block');
  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
  res.setHeader('Permissions-Policy', 'camera=(), geolocation=(), microphone=()');
  res.setHeader(
    'Content-Security-Policy',
    "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; media-src 'self' blob: https:; connect-src 'self' https: ws: wss:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self';"
  );

  if (req?.secure || (!req && options.secureByDefault)) {
    res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
  }
  res.removeHeader('X-Powered-By');
}

function securityHeadersMiddleware(options = {}) {
  return (req, res, next) => {
    applySecurityHeaders(req, res, options);
    next();
  };
}

function createHttpsEnforcementMiddleware({ enabled = false } = {}) {
  return (req, res, next) => {
    const remoteAddress = req.socket?.remoteAddress || '';
    const isLocalHealthCheck = req.path === '/api/health' && LOCAL_HEALTH_ADDRESSES.has(remoteAddress);
    if (!enabled || isLocalHealthCheck || req.secure) return next();

    return res.status(400).json({
      success: false,
      message: '仅支持HTTPS访问，请使用HTTPS',
      requestId: req.id
    });
  };
}

module.exports = {
  applySecurityHeaders,
  createHttpsEnforcementMiddleware,
  securityHeadersMiddleware
};