<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class EnforceLocalOnly
{
    public function handle(Request $request, Closure $next)
    {
        $response = $next($request);

        if (! config('app.offline')) {
            return $response;
        }

        $businessMediaOrigin = config('business_storage.driver') === 'qiniu'
            ? rtrim((string) config('business_storage.qiniu.private_domain'), '/')
            : '';
        $businessMediaSource = $businessMediaOrigin !== ''
            ? ' ' . $businessMediaOrigin
            : '';

        $response->headers->set('Content-Security-Policy', implode('; ', [
            "default-src 'self'",
            "base-uri 'self'",
            "connect-src 'self'",
            "font-src 'self' data:",
            "form-action 'self'",
            "frame-src 'self'",
            "img-src 'self'{$businessMediaSource} data: blob:",
            "media-src 'self'{$businessMediaSource}",
            "object-src 'none'",
            "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
            "style-src 'self' 'unsafe-inline'",
            "navigate-to 'self'",
        ]));

        return $response;
    }
}