# frozen_string_literal: true
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
require 'booru/config'

in_staging_or_production = Rails.env.staging? || Rails.env.production?

Rails.application.config.content_security_policy do |policy|
  policy.default_src     :self, :data, "'unsafe-inline'", 'js-agent.newrelic.com', *(Booru::CONFIG.settings[:origin_hosts] + [Booru::CONFIG.settings[:cdn_url_root]])
  policy.object_src      :none
  policy.frame_ancestors :none
  policy.frame_src       :self
  policy.form_action     :self
  policy.manifest_src    :self

  if in_staging_or_production
    policy.img_src :self, :data, Booru::CONFIG.settings[:cdn_url_root], Booru::CONFIG.settings[:camo_host]
  else
    policy.img_src '*', :data
  end

  policy.block_all_mixed_content

  # Specify URI for violation reports
  # policy.report_uri "/csp-violation-report-endpoint"
end