use crate::error::ErrorResponse;
use axum::response::IntoResponse;
use axum::{
    extract::Request,
    http::{
        header::{HeaderName, HeaderValue},
        StatusCode,
    },
    middleware::Next,
    response::Response,
};

pub async fn security_headers(req: Request, next: Next) -> Response {
    let mut response = next.run(req).await;
    let headers = response.headers_mut();
    headers.insert(
        "x-content-type-options",
        HeaderValue::from_static("nosniff"),
    );
    headers.insert("x-frame-options", HeaderValue::from_static("DENY"));
    headers.insert("referrer-policy", HeaderValue::from_static("no-referrer"));
    headers.insert(
        HeaderName::from_static("permissions-policy"),
        HeaderValue::from_static("camera=(), microphone=(), geolocation=()"),
    );
    response
}

pub async fn fallback_404() -> Response {
    ErrorResponse::not_found("route not found").into_response()
}
pub async fn fallback_405() -> Response {
    ErrorResponse {
        status: StatusCode::METHOD_NOT_ALLOWED,
        message: "method not allowed".into(),
    }
    .into_response()
}
