use fastly::http::header;
use fastly::{Error, Request, Response};

#[fastly::main]
fn main(req: Request) -> Result<Response, Error> {
    let is_debug = req.contains_header("Fastly-Debug");
    let mut beresp = req.send("origin_0")?;
    beresp.set_header(header::CONTENT_SECURITY_POLICY, "default-src 'self'");
    beresp.set_header(header::X_FRAME_OPTIONS, "SAMEORIGIN");
    beresp.set_header(header::X_XSS_PROTECTION, "1");
    beresp.set_header(header::X_CONTENT_TYPE_OPTIONS, "nosniff");
    beresp.set_header(header::REFERRER_POLICY, "origin-when-cross-origin");
    beresp.set_header(
        header::STRICT_TRANSPORT_SECURITY,
        "max-age=31536000; includeSubDomains",
    );
    beresp.set_header("Expect-CT", "enforce, max-age=30");
    if !is_debug {
        beresp.remove_header(header::SERVER);
        beresp.remove_header(header::VIA);
        beresp.remove_header("X-Powered-By");
        beresp.remove_header("X-Cache-Hits");
        beresp.remove_header("X-Cache");
        beresp.remove_header("X-Served-By");
        beresp.remove_header("X-Timer");
    }
    let has_max_age = beresp
        .get_header_str(header::CACHE_CONTROL)
        .unwrap_or("")
        .split(',')
        .any(|directive| {
            directive
                .split('=')
                .next()
                .unwrap_or("")
                .trim()
                .eq_ignore_ascii_case("max-age")
        });
    if has_max_age {
        beresp.remove_header(header::EXPIRES);
    }
    Ok(beresp)
}