<?php
/**
 * Security HTTP headers (Lighthouse "Best Practices").
 */

defined( 'ABSPATH' ) || exit;

class CTPS_Headers {

	public static function init() {
		if ( CTPS_Settings::on( 'security_headers' ) ) {
			add_action( 'send_headers', array( __CLASS__, 'send_security_headers' ) );
		}
		add_action( 'send_headers', array( __CLASS__, 'send_vary' ) );
	}

	/**
	 * Phones and computers get different cached copies: tell proxies and CDNs.
	 */
	public static function send_vary() {
		if ( headers_sent() || is_admin() || ! CTPS_Settings::on( 'page_cache' ) || ! class_exists( 'CTPS_Page_Cache' ) || ! CTPS_Page_Cache::mobile_variant() ) {
			return;
		}
		header( 'Vary: User-Agent', false );
	}

	/**
	 * Header lines shared by PHP responses and the early cache drop-in.
	 * Permissions-Policy is sent only when the 'ctps_permissions_policy'
	 * filter returns a value (camera, microphone and geolocation stay usable
	 * by maps, store locators and video embeds).
	 *
	 * @param bool $embed oEmbed request: no X-Frame-Options, the page is meant to be framed.
	 */
	public static function header_lines( $embed = false ) {
		$lines = array( 'X-Content-Type-Options: nosniff', 'Referrer-Policy: strict-origin-when-cross-origin' );
		if ( ! $embed ) {
			$lines[] = 'X-Frame-Options: SAMEORIGIN';
		}
		// Allows popups (PayPal, social login) but isolates the page.
		$lines[] = 'Cross-Origin-Opener-Policy: same-origin-allow-popups';
		$policy  = function_exists( 'apply_filters' ) ? apply_filters( 'ctps_permissions_policy', '' ) : '';
		$policy  = is_string( $policy ) ? trim( preg_replace( '/[\r\n]+/', ' ', $policy ) ) : '';
		if ( '' !== $policy ) {
			$lines[] = 'Permissions-Policy: ' . $policy;
		}
		return $lines;
	}

	/**
	 * @param WP|null $wp Passed by the send_headers action (query vars already parsed).
	 */
	public static function send_security_headers( $wp = null ) {
		if ( headers_sent() || ! CTPS_Settings::on( 'security_headers' ) ) {
			return;
		}
		$embed = ( is_object( $wp ) && ! empty( $wp->query_vars['embed'] ) ) || ( did_action( 'wp' ) && is_embed() );
		foreach ( self::header_lines( $embed ) as $line ) {
			header( $line );
		}
		// HSTS is hard to undo (browsers remember it for a year): opt-in only.
		if ( is_ssl() && apply_filters( 'ctps_send_hsts', false ) ) {
			header( 'Strict-Transport-Security: max-age=31536000' );
		}
	}
}