"""
Middleware that applies clickjacking protection headers to every response.

Previously also allowed iframe embedding for a native mobile app's WebView
(detected via User-Agent); that app has been retired in favor of the PWA,
so the headers are now applied unconditionally.
"""


class SecurityHeadersMiddleware:
    """Add X-Frame-Options and a CSP frame-ancestors policy to every response."""

    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        response = self.get_response(request)

        if 'X-Frame-Options' not in response:
            response['X-Frame-Options'] = 'DENY'

        if 'Content-Security-Policy' not in response:
            response['Content-Security-Policy'] = (
                "default-src 'self'; "
                "script-src 'self' 'unsafe-inline'; "
                "style-src 'self' 'unsafe-inline'; "
                "img-src 'self' data: https:; "
                "font-src 'self' data:; "
                "connect-src 'self'; "
                "frame-ancestors 'none'; "
                "base-uri 'self'; "
                "form-action 'self';"
            )

        return response