<?php

namespace App\Http\Middleware;

use Closure;
use Session;

class CSP
{
    private $hash;

    /**
     * @access private
     * @var array las directivas de csp
     */
    private $directivas = [];


    public function __construct(){
        $this->hash = hash('sha512',random_int(100,1000));
        //
        $this->almacenarNonce();
        //
        $this->directivas = [
            "default-src" => "'self' https:",
            "img-src" => "'self' https:",
            "font-src" => "'self' https://fonts.gstatic.com", 
            "script-src" => "'self' https: 'nonce-$this->hash'",
            "style-src" => "'self' https:",
            "object-src" => "'none'",
            "media-src" => "'self'",
            "frame-ancestors" => "'none'",
            "connect-src" => "'self'",
            "base-uri" => "'none'"
        ];
    }

    /**
     * Define los parametros del Content-Security-Policy
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        $response = $next($request);
        $response->headers->set('Content-Security-Policy',self::parsearDirectivas());
        return $response;
    }

    /**
     * Transforma el arreglo de directivas a string del CSP
     * 
     * @access private
     * @param array las directivas
     * @return string las directivas en cadena
     */
    private function parsearDirectivas()
    {
        $str_dire = '';
        foreach($this->directivas as $key => $val ){
            $str_dire .= $key.' '.$val.'; ';
        }
        return $str_dire;
    }

    private function almacenarNonce(){
        //
        if ( !is_null($this->hash) ){
            if ( Session::has('nonce') ){
                Session::set('nonce',$this->hash);
            } else {
                Session::put('nonce',$this->hash);
            }
            
        }
    }
}