/**
 * Build a Content-Security-Policy value.
 * Scripts: nonce for Next.js / first-party inline; host allowlists for captcha,
 * Cloudflare Insights, and TinyMCE CDN. style-src keeps 'unsafe-inline' for
 * theme CSS variables (ThemeVars) — nonce styles are a follow-up.
 */
export function buildContentSecurityPolicy(nonce: string): string {
	const isDev = process.env.NODE_ENV === "development";
	const scriptSrc = [
		"'self'",
		`'nonce-${nonce}'`,
		"https://challenges.cloudflare.com",
		"https://www.google.com/recaptcha/",
		"https://www.gstatic.com/recaptcha/",
		"https://static.cloudflareinsights.com",
		"https://cdn.jsdelivr.net",
		...(isDev ? ["'unsafe-eval'"] : []),
	].join(" ");

	return [
		"default-src 'self'",
		`script-src ${scriptSrc}`,
		"style-src 'self' 'unsafe-inline'",
		"img-src 'self' data: blob: https:",
		"frame-src 'self' https://challenges.cloudflare.com https://www.google.com/recaptcha/",
		"connect-src 'self' https: wss:",
		"font-src 'self' data:",
		"object-src 'none'",
		"base-uri 'self'",
		"form-action 'self'",
	].join("; ");
}

export function createCspNonce(): string {
	return Buffer.from(crypto.randomUUID()).toString("base64");
}