import type { NextConfig } from "next";
import { withSentryConfig } from "@sentry/nextjs";
import createNextIntlPlugin from "next-intl/plugin";

const securityHeaders = [
	{ key: "X-DNS-Prefetch-Control", value: "on" },
	{
		key: "Strict-Transport-Security",
		value: "max-age=63072000; includeSubDomains; preload",
	},
	{ key: "X-Frame-Options", value: "DENY" },
	{ key: "X-Content-Type-Options", value: "nosniff" },
	{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
	{
		key: "Permissions-Policy",
		value: "camera=(), microphone=(), geolocation=(), interest-cohort=()",
	},
	{
		key: "Content-Security-Policy",
		value: [
			"default-src 'self'",
			"script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://static.cloudflareinsights.com",
			"style-src 'self' 'unsafe-inline'",
			"img-src 'self' data: blob: https:",
			"frame-src 'self' https://challenges.cloudflare.com https://www.google.com/recaptcha/",
			"connect-src 'self' https: wss:",
			"font-src 'self' data:",
			"object-src 'none'",
			"base-uri 'self'",
			"form-action 'self'",
		].join("; "),
	},
];

const nextConfig: NextConfig = {
	turbopack: { root: import.meta.dirname },
	serverExternalPackages: [
		"@prisma/adapter-mariadb",
		"mariadb",
		"@prisma/client",
		"lzma",
		"sharp",
		"pino",
		"pino-pretty",
	],

	// Compress responses with gzip
	compress: true,

	// Cache pages longer in the router cache for faster back/forward navigation
	experimental: {
		staleTimes: {
			dynamic: 30,
			static: 180,
		},
	},

	// Add caching headers for static assets
	async headers() {
		return [
			{
				source: "/(.*)",
				headers: securityHeaders,
			},
			{
				source: "/assets/(.*)",
				headers: [
					{
						key: "Cache-Control",
						value: "public, max-age=31536000, immutable",
					},
				],
			},
			{
				source: "/images/(.*)",
				headers: [{ key: "Cache-Control", value: "public, max-age=86400" }],
			},
		];
	},
};

// next-intl WITHOUT i18n routing — locale comes from the NEXT_LOCALE cookie via
// src/i18n/request.ts, so URLs and the access-guard middleware stay unchanged.
const withNextIntl = createNextIntlPlugin("./src/i18n/request.ts");

const config = withNextIntl(nextConfig);

// Source-map upload + release creation need SENTRY_AUTH_TOKEN.
// Without it, keep the SDK wrapper but skip remote Sentry build steps
// so CI/prod compile stays quiet (runtime DSN still works independently).
const sentryAuthToken = process.env.SENTRY_AUTH_TOKEN;

export default withSentryConfig(config, {
	org: process.env.SENTRY_ORG,
	project: process.env.SENTRY_PROJECT,
	authToken: sentryAuthToken,
	silent: !process.env.CI,
	widenClientFileUpload: true,
	sourcemaps: {
		disable: !sentryAuthToken,
	},
	release: {
		create: Boolean(sentryAuthToken),
	},
});