import * as plugins from './plugins.js';

/** Static inspector code is public; all inspected data uses authenticated streams. */
export const createBrowserDevToolsSurface = (hostnames: string[]): plugins.typedserver.ITypedServerSurface => {
  const devToolsAssets = plugins.smartbrowser.getDevToolsFrontendAssets();
  return {
    name: 'browser-devtools',
    match: { hostnames, pathPrefixes: [devToolsAssets.urlPrefix] },
    typedRequestPath: false,
    includeBuiltinTypedHandlers: false,
    serveDir: devToolsAssets.serveDirectory,
    spaFallback: false,
    healthzEndpoint: false,
    cors: false,
    noCache: false,
    requestAdmission: context => ['GET', 'HEAD'].includes(context.method) ? true
      : new Response('Method not allowed', { status: 405, headers: { Allow: 'GET, HEAD' } }),
    securityHeaders: {
      csp: {
        defaultSrc: ["'self'"], scriptSrc: ["'self'", "'wasm-unsafe-eval'"],
        styleSrc: ["'self'", "'unsafe-inline'"], imgSrc: ["'self'", 'data:', 'blob:'],
        fontSrc: ["'self'", 'data:'], connectSrc: ["'self'", 'data:'],
        frameSrc: ["'self'", 'data:'], workerSrc: ["'self'", 'blob:'],
        objectSrc: ["'none'"], frameAncestors: ["'self'"], baseUri: ["'none'"], formAction: ["'none'"],
      },
      xFrameOptions: 'SAMEORIGIN', xContentTypeOptions: true,
      referrerPolicy: 'no-referrer', crossOriginResourcePolicy: 'same-origin',
    },
  };
};