"""Defense-in-depth response headers for the local web UI.

These do not replace correct output encoding — they bound the damage when it
fails. The UI renders plenty of externally-influenced strings (remote hostnames
harvested over ssh, GPU model names from nvidia-smi, package names, connector
metadata), and several still reach the DOM through innerHTML. A strict CSP is
what stops an injected `<script>` from running or phoning home.

All executable UI scripts are same-origin static files. Keeping executable
code out of HTML means the policy needs neither a nonce nor a dynamically
derived hash, and avoids having a security decision depend on duplicating the
browser's full HTML tokenizer. Nothing here reads a file: the policies are
constants, and the one directive that varies — `frame-ancestors` — varies by
who embeds a document rather than by what the document contains.
"""

from __future__ import annotations

import os
import unicodedata
from collections.abc import Sequence
from urllib.parse import quote


def artifact_content_security_policy() -> str:
    """Policy for untrusted, user- or agent-authored Artifact bytes.

    Artifact HTML may be opened directly as well as inside the Workbench's
    sandboxed iframe, so the sandbox rides the response and applies in either
    navigation mode.

    App-origin Artifact HTML never executes script. The ordinary preview,
    direct download, and frozen legacy iframe retain this inert policy.
    Only the separately validated, Host-bound grant namespace may use the
    executable sandbox policy below.

    `allow-same-origin` is the one sandbox token granted, and it buys back the
    sub-resources a report needs. Without it the document is on an opaque
    origin, where `'self'` matches nothing and `<img src="figure.png">` — the
    standard Code-as-Action pair, which `store.artifact_by_unique_filename`
    exists to resolve — fails to load even on a top-level View. It grants no
    active capability while `script-src 'none'` and the missing `allow-scripts`
    stand: with no script there is nothing to read a cookie or a sibling
    document with.
    """
    return "; ".join(
        [
            "default-src 'none'",
            "script-src 'none'",
            "style-src 'self' 'unsafe-inline'",
            "img-src 'self' data: blob:",
            "font-src 'self' data:",
            "media-src 'self' data: blob:",
            "connect-src 'none'",
            "object-src 'none'",
            "base-uri 'none'",
            "form-action 'none'",
            "frame-ancestors 'self'",
            "sandbox allow-same-origin",
        ]
    )


def _one_minting_origin(app_origin: str) -> str:
    """Refuse anything but a single, whole `http://` origin.

    The first draft of this policy took a *sequence* of ancestors and was
    handed both loopback names, which let a report navigate its own frame
    from the sandbox name to the cookie name and stay framed. The type now
    says what the data already is: a grant is minted by exactly one origin,
    and that origin is the only permitted ancestor. Anything else is a
    caller bug, and a caller bug here must not degrade into a wider policy.
    """
    origin = str(app_origin or "")
    if (
        not origin.startswith("http://")
        or origin.endswith("/")
        or any(ch.isspace() for ch in origin)
        or ";" in origin
        or "," in origin
    ):
        raise ValueError("sandbox preview needs exactly one minting origin")
    return origin


def sandboxed_artifact_content_security_policy(app_origin: str) -> str:
    """Policy for artifact bytes served on the *sandbox* origin.

    The grant route must validate its signed spend origin before selecting
    this policy. Cross-origin isolation protects the embedding Workbench;
    the grant namespace accepts no session credential and exposes only scoped
    Artifact snapshots. Other previews share the same browser origin.

    Fetches, forms, and external resources are blocked, but an iframe can
    navigate itself. Such navigation can disclose its bearer path and readable
    bytes. This policy is not a general data-exfiltration boundary.

    `frame-ancestors` names the one minting origin literally: `'self'` would
    mean the sandbox origin, which is not who embeds this.
    """
    ancestors = _one_minting_origin(app_origin)
    return "; ".join(
        [
            "default-src 'none'",
            # The document's own inline script is the point of this origin.
            "script-src 'self' 'unsafe-inline'",
            "style-src 'self' 'unsafe-inline'",
            "img-src 'self' data: blob:",
            "font-src 'self' data:",
            "media-src 'self' data: blob:",
            "connect-src 'none'",
            "object-src 'none'",
            "base-uri 'none'",
            "form-action 'none'",
            f"frame-ancestors {ancestors}",
            # `allow-same-origin` is safe here and not on the app origin: this
            # document's origin is the sandbox, so keeping it buys `'self'` for
            # sub-resources without granting reach into anything.
            "sandbox allow-scripts allow-same-origin",
        ]
    )


def sandboxed_artifact_security_headers(app_origin: str) -> dict[str, str]:
    """Headers for an executable artifact preview on the sandbox origin."""
    headers = security_headers()
    headers["Content-Security-Policy"] = sandboxed_artifact_content_security_policy(
        app_origin
    )
    headers["Referrer-Policy"] = "no-referrer"
    headers["Cache-Control"] = "no-store"
    # Dropped, not set to a permissive value: `X-Frame-Options` has no "this
    # origin" form, and its non-standard `ALLOWALL` relies on browsers
    # ignoring a value they cannot parse. `frame-ancestors` is the standard
    # control and takes precedence wherever both appear, so the honest thing
    # is to let it be the only one.
    headers.pop("X-Frame-Options", None)
    return headers


def artifact_security_headers() -> dict[str, str]:
    """Hardened headers for an embeddable, untrusted Artifact document."""
    headers = security_headers()
    headers["Content-Security-Policy"] = artifact_content_security_policy()
    # The Workbench embeds same-origin previews. DENY would make that secure by
    # rendering nothing; SAMEORIGIN preserves the product while the CSP sandbox
    # removes the preview document's active capabilities.
    headers["X-Frame-Options"] = "SAMEORIGIN"
    return headers


#: Unicode categories dropped from a served filename: controls (CR/LF split a
#: header), format characters (a right-to-left override disguises the
#: extension), surrogates (not encodable) and private use, plus the line and
#: paragraph separators.
_DISPOSITION_DROPPED_CATEGORIES = frozenset({"Cc", "Cf", "Cs", "Co", "Zl", "Zp"})
#: What the legacy ``filename`` quoted-string keeps; anything else becomes
#: ``_``. No quote or backslash (they end or escape the string), no ``;`` or
#: ``%`` (parsers that split or percent-decode naively), no path separator.
_DISPOSITION_ASCII_KEPT = frozenset(
    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 !#$&'()+,-.=@[]^_`{}~"
)
_DISPOSITION_NAME_MAX = 180


def artifact_content_disposition(filename: object, fallback: str = "artifact") -> str:
    """``Content-Disposition`` for Artifact bytes: shown in place, saved by name.

    Without it a browser that downloads rather than renders a type (``text/csv``)
    names the file after the URL's last path segment, so a completion link to
    ``group_summary.csv`` saved ``a-7b61bc5806b9.csv``. ``inline``, never
    ``attachment``: PNG, HTML and the Workbench's preview iframe still render
    in place.

    The stored name is agent- or user-authored, which makes it the one header
    value on the route an Artifact controls. Only its last path component is
    used, the categories above and double quotes are removed, and it is sent
    twice: an ASCII ``filename`` for old clients and an RFC 5987 ``filename*``
    carrying the exact UTF-8 name, which current browsers prefer.
    """
    raw = str(filename or "").replace("\\", "/").rsplit("/", 1)[-1]
    name = "".join(
        ch
        for ch in raw
        if ch != '"' and unicodedata.category(ch) not in _DISPOSITION_DROPPED_CATEGORIES
    ).strip()
    if name in {"", ".", ".."}:
        name = fallback
    if len(name) > _DISPOSITION_NAME_MAX:
        stem, extension = os.path.splitext(name)
        if 0 < len(extension) <= 16:
            name = stem[: _DISPOSITION_NAME_MAX - len(extension)] + extension
        else:
            name = name[:_DISPOSITION_NAME_MAX]
    decomposed = unicodedata.normalize("NFKD", name)
    ascii_name = "".join(
        ch if ch in _DISPOSITION_ASCII_KEPT else "_"
        for ch in decomposed
        if not unicodedata.combining(ch)
    )
    return f"inline; filename=\"{ascii_name}\"; filename*=UTF-8''{quote(name, safe='')}"


def embeddable_security_headers(*, allow_eval: bool = False) -> dict[str, str]:
    """Headers for a UI-owned document the Workbench loads in an iframe.

    `/ketcher` and the vendored editor it frames are first-party documents, not
    Artifact bytes: they keep the shell's `script-src 'self'` and same-origin
    `connect-src`. What they cannot keep is the shell's frame denial, because
    the product's only way to reach them is an iframe of the workbench page.
    `DENY` there is not a policy, it is the editor never rendering.
    """
    headers = security_headers()
    headers["Content-Security-Policy"] = content_security_policy(
        frame_ancestors="'self'", allow_eval=allow_eval
    )
    headers["X-Frame-Options"] = "SAMEORIGIN"
    return headers


def ketcher_editor_security_headers() -> dict[str, str]:
    """Allow the pinned first-party editor's generated chemistry bindings.

    Ketcher 3.7.0 uses JavaScript string compilation as well as WebAssembly.
    Without this permission its initialization raises EvalError and structure
    import/export waits forever. Only the exact vendored editor document uses
    this profile; its blob worker inherits it. The wrapper, Workbench, and
    all untrusted Artifact responses keep their existing no-eval policies.
    """
    return embeddable_security_headers(allow_eval=True)


def content_security_policy(
    *,
    frame_ancestors: str = "'none'",
    frame_src: Sequence[str] = (),
    allow_eval: bool = False,
) -> str:
    """Return the static UI-shell policy.

    ``allow_eval`` is the one directive that varies by what the document
    *contains*: it exists for a single pinned first-party bundle that compiles
    JavaScript strings, and nothing model-authored is ever built with it.

    Two more directives vary, and both vary by *who is on the other side of a
    frame boundary* rather than by what this document contains:

    ``frame_ancestors``
        who may embed this document.
    ``frame_src``
        who this document may embed. It has to name the sandbox origin
        explicitly: `default-src 'self'` is the `frame-src` fallback, and the
        sandbox origin is deliberately a *different* origin, so the shell's own
        policy refuses to frame it until it is named. That is not theoretical
        -- it is what Chromium did, with "Framing 'http://localhost:PORT/'
        violates ... default-src 'self'", while every response header on the
        sandbox side was already correct.
    """
    script_src = ["'self'"]
    if allow_eval:
        # 'unsafe-eval' already covers WebAssembly compilation, so the narrower
        # keyword below would be dead weight beside it.
        script_src.append("'unsafe-eval'")
    else:
        # 3Dmol compiles WebAssembly for molecular surfaces. 'wasm-unsafe-eval'
        # permits exactly that and nothing else — unlike 'unsafe-eval', it does
        # not re-enable eval()/new Function() for injected script.
        script_src.append("'wasm-unsafe-eval'")

    policy = "; ".join(
        [
            # Everything the app needs ships with it; nothing is fetched from a
            # third party, so the default can be closed.
            "default-src 'self'",
            f"script-src {' '.join(script_src)}",
            # style-src keeps 'unsafe-inline': the UI sets style="" attributes
            # through innerHTML in a handful of places. Style injection cannot
            # execute script, so this is the cheap concession, not script-src.
            "style-src 'self' 'unsafe-inline'",
            # data: for icons, blob: for figures/structures built client-side.
            "img-src 'self' data: blob:",
            "font-src 'self' data:",
            # Same-origin only. This is the exfiltration bound: an injected
            # script cannot POST harvested data to an attacker's host.
            "connect-src 'self'",
            "worker-src 'self' blob:",
            "object-src 'none'",
            "base-uri 'none'",
            "form-action 'self'",
            " ".join(["frame-src", "'self'", *frame_src]),
            f"frame-ancestors {frame_ancestors}",
        ]
    )
    return policy


def security_headers(*, frame_src: Sequence[str] = ()) -> dict[str, str]:
    """Headers applied to every response the gateway emits."""
    return {
        "Content-Security-Policy": content_security_policy(frame_src=frame_src),
        # The gateway serves user/agent-authored artifacts; sniffing turns a
        # text/plain artifact into an executable document.
        "X-Content-Type-Options": "nosniff",
        # frame-ancestors already covers this for modern browsers; kept for
        # older ones since clickjacking a localhost control plane is cheap.
        "X-Frame-Options": "DENY",
        # The daemon is loopback-only, but paths and session ids do not belong
        # in a Referer header if a user ever proxies it.
        "Referrer-Policy": "same-origin",
        "Permissions-Policy": "geolocation=(), microphone=(), camera=()",
    }


__all__ = [
    "artifact_content_security_policy",
    "artifact_security_headers",
    "content_security_policy",
    "embeddable_security_headers",
    "ketcher_editor_security_headers",
    "sandboxed_artifact_content_security_policy",
    "sandboxed_artifact_security_headers",
    "security_headers",
]