<?php
/**
 * Security Headers
 *
 * Sends security-hardening HTTP headers on every response.
 * Values are configurable via wp-admin settings.
 *
 * @package GuardianShield
 */

namespace GuardianShield;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class SecurityHeaders {

	public function send(): void {
		if ( ! (bool) gs_get_option( 'headers_enabled', true ) ) {
			return;
		}

		header( 'X-Content-Type-Options: nosniff' );
		header( 'X-Frame-Options: SAMEORIGIN' );
		header( 'X-XSS-Protection: 1; mode=block' );
		header( 'Referrer-Policy: strict-origin-when-cross-origin' );
		header( 'Permissions-Policy: geolocation=(), microphone=(), camera=(), payment=()' );

		if ( is_ssl() && (bool) gs_get_option( 'hsts_enabled', true ) ) {
			$max_age = (int) gs_get_option( 'hsts_max_age', 31536000 );
			header( "Strict-Transport-Security: max-age={$max_age}; includeSubDomains" );
		}

		if ( (bool) gs_get_option( 'csp_enabled', true ) ) {
			$csp = gs_get_option( 'csp_policy', $this->default_csp() );
			if ( ! empty( $csp ) ) {
				header( "Content-Security-Policy: {$csp}" );
			}
		}
	}

	private function default_csp(): string {
		return "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'";
	}
}
