import type * as Assets from '../Assets.js'

const svgContentSecurityPolicy =
  "base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'; img-src data:; sandbox; style-src 'unsafe-inline'"

/** Version that invalidates unsafe response caches and validators. */
export const version = 'svg-sandbox-v1'

/** Builds response headers that prevent stored SVG assets from executing as documents. */
export function headers(asset: Assets.Asset) {
  const contentType = asset.contentType.split(';')[0]?.trim().toLowerCase()
  return {
    ...(contentType === 'image/svg+xml'
      ? { 'Content-Security-Policy': svgContentSecurityPolicy }
      : {}),
    'Content-Type': asset.contentType,
    'X-Content-Type-Options': 'nosniff',
  }
}

/** Adds the response version to a client-visible or internal cache URL. */
export function versionUrl(url: string) {
  const value = new URL(url, 'http://localhost')
  value.searchParams.set('__response', version)
  return url.startsWith('/') ? `${value.pathname}${value.search}` : value.toString()
}