package middleware

import (
	"RenewCMS/api/pkg/apperr"
	"net/http"
	"net/url"
)

func CrossOriginProtection(publicURL string) func(http.Handler) http.Handler {
	protection := http.NewCrossOriginProtection()
	if origin, ok := originOf(publicURL); ok {
		_ = protection.AddTrustedOrigin(origin)
	}
	protection.SetDenyHandler(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		http.Error(w, apperr.CrossOriginErrorMessage, http.StatusForbidden)
	}))

	return func(next http.Handler) http.Handler {
		protected := protection.Handler(next)
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			if r.Header.Get("Authorization") != "" {
				next.ServeHTTP(w, r)
				return
			}
			protected.ServeHTTP(w, r)
		})
	}
}

func originOf(rawURL string) (string, bool) {
	parsed, err := url.Parse(rawURL)
	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
		return "", false
	}
	return parsed.Scheme + "://" + parsed.Host, true
}