import ipaddress

from fastapi.responses import JSONResponse

SECURITY_HEADERS = {
    "Content-Security-Policy": (
        "default-src 'self'; "
        "script-src 'self' https://cdn.plot.ly; "
        "style-src 'self' 'unsafe-inline'; "
        "img-src 'self' data:; "
        "connect-src 'self'; "
        "font-src 'self' data:; "
        "object-src 'none'; "
        "base-uri 'self'; "
        "frame-ancestors 'none'"
    ),
    "Referrer-Policy": "no-referrer",
    "X-Content-Type-Options": "nosniff",
    "X-Frame-Options": "DENY",
}


def add_security_headers(response):
    for key, value in SECURITY_HEADERS.items():
        response.headers[key] = value
    return response


def is_lan_or_loopback(host):
    if not host:
        return True
    try:
        ip_obj = ipaddress.ip_address(host)
    except ValueError:
        return True
    return ip_obj.is_private or ip_obj.is_loopback


def lan_denied_response():
    return add_security_headers(
        JSONResponse(
            status_code=403,
            content={"detail": "Access Denied: Only LAN connections are allowed."},
        )
    )