import type { SecurityConfig } from "@wrnexus/core";

export type SecurityPreset = "balanced" | "strict" | "api";

export function securityPreset(preset: SecurityPreset = "balanced"): SecurityConfig {
  if (preset === "api") {
    return {
      contentSecurityPolicy: false,
      frameOptions: "DENY",
      crossOriginOpenerPolicy: "same-origin",
      referrerPolicy: "no-referrer",
      permissionsPolicy: {},
      extraHeaders: {
        "Cross-Origin-Resource-Policy": "same-origin",
        "Cache-Control": "no-store",
      },
    };
  }
  if (preset === "strict") {
    return {
      contentSecurityPolicy: {
        useDefaults: true,
        directives: {
          "style-src": ["'self'"],
          "script-src": ["'self'"],
          "upgrade-insecure-requests": [],
        },
      },
      trustedTypes: { enabled: true, policyNames: ["wrnexus"], requireForScript: true },
      hsts: { enabled: true, maxAge: 63_072_000, includeSubDomains: true, preload: true },
      extraHeaders: {
        "Cross-Origin-Resource-Policy": "same-origin",
        "Origin-Agent-Cluster": "?1",
      },
    };
  }
  return {
    contentSecurityPolicy: { useDefaults: true },
    trustedTypes: { enabled: true, requireForScript: true },
    extraHeaders: { "Cross-Origin-Resource-Policy": "same-origin" },
  };
}