/**
 * Myext injecting policy to page using webRequest
 *
 * Copyright (C) 2021 Wojtek Kosior
 * Redistribution terms are gathered in the `copyright' file.
 */

"use strict";

(() => {
    const TYPE_PREFIX = window.TYPE_PREFIX;
    const get_storage = window.get_storage;
    const browser = window.browser;
    const is_chrome = window.is_chrome;
    const gen_unique = window.gen_unique;
    const url_item = window.url_item;
    const get_query_best = window.get_query_best;

    var storage;
    var query_best;

    let csp_header_names = {
	"content-security-policy" : true,
	"x-webkit-csp" : true,
	"x-content-security-policy" : true
    };

    function is_noncsp_header(header)
    {
	return !csp_header_names[header.name.toLowerCase()];
    }

    function inject(details)
    {
	let url = url_item(details.url);

	let [pattern, settings] = query_best(url);

	if (settings !== undefined && settings.allow) {
	    console.log("allowing", url);
	    return {cancel : false};
	}

	let nonce = gen_unique(url).substring(1);
	let headers = details.responseHeaders.filter(is_noncsp_header);
	headers.push({
	    name : "content-security-policy",
	    value : `script-src 'nonce-${nonce}'; script-src-elem 'nonce-${nonce}';`
	});

	console.log("modified headers", url, headers);

	return {responseHeaders: headers};
    }

    async function start() {
	storage = await get_storage();
	query_best = await get_query_best();

	let extra_opts = ["blocking", "responseHeaders"];
	if (is_chrome)
	    extra_opts.push("extraHeaders");

	browser.webRequest.onHeadersReceived.addListener(
	    inject,
	    {
		urls: ["<all_urls>"],
		types: ["main_frame", "sub_frame"]
	    },
	    extra_opts
	);
    }

    window.start_policy_injector = start;
})();