package middleware

import (
	"net/http"

	"github.com/gin-gonic/gin"
)

// SecurityHeaders 设置安全响应头中间件。
// 设置：X-Content-Type-Options: nosniff
//
//	X-Frame-Options: DENY
//	Referrer-Policy: strict-origin-when-cross-origin
//	Strict-Transport-Security: max-age=31536000; includeSubDomains
//	Content-Security-Policy: default-src 'self'
//	移除 Server 头
func SecurityHeaders() gin.HandlerFunc {
	return func(c *gin.Context) {
		h := c.Writer.Header()
		h.Set("X-Content-Type-Options", "nosniff")
		h.Set("X-Frame-Options", "DENY")
		h.Set("Referrer-Policy", "strict-origin-when-cross-origin")
		h.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
		h.Set("Content-Security-Policy", "default-src 'self'")
		h.Del("Server")
		c.Next()
		// 响应处理结束后再次移除 Server 头，防止处理过程中被写入
		c.Writer.Header().Del("Server")
	}
}

// RequestBodyLimit 限制请求体大小中间件。
// 超限时返回 413 + ActionState 信封（W1/W2 裁决）：
//
//	{"success":false,"error":{"code":"GW_REQUEST_TOO_LARGE","message":"..."}}
//
// 通过 Content-Length 预检 + http.MaxBytesReader 双重保障：
//   - Content-Length 预检：已知大小的请求体立即拒绝（JSON 信封响应）
//   - MaxBytesReader：流式请求体（无 Content-Length）读取超限时由标准库返回 413
func RequestBodyLimit(maxBytes int64) gin.HandlerFunc {
	return func(c *gin.Context) {
		if c.Request.ContentLength > maxBytes {
			abortGW(c, http.StatusRequestEntityTooLarge, "GW_REQUEST_TOO_LARGE", "request body too large")
			return
		}
		c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxBytes)
		c.Next()
	}
}
