package egovframework.com.its.web.server.config;

import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@Slf4j
@Component
public class CorsFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        log.info("Start Method checking");
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletResponse res = (HttpServletResponse) response;
        HttpServletRequest req = (HttpServletRequest) request;
        res.setHeader("Cache-Control", "no-store");
        res.setHeader("Pragma", "no-cache");
        res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
        if (request.getProtocol().equals("HTTP/1.1")) res.setHeader("Cache-Control", "no-cache");
        res.setHeader("Content-Security-Policy",
                "default-src 'self' ws://its1.pyeongtaek.go.kr wss://its1.pyeongtaek.go.kr https://dapi.kakao.com http://*.daumcdn.net https://*.daumcdn.net; "+
                "script-src 'self' 'unsafe-inline' https://code.jquery.com/ui/1.12.1/jquery-ui.js https://code.jquery.com/jquery-3.2.1.min.js https://dapi.kakao.com http://*.daumcdn.net https://*.daumcdn.net; " +
                "style-src 'self' 'unsafe-inline' https://code.jquery.com/ui/1.12.1/themes/base/jquery-ui.css https://dapi.kakao.com http://*.daumcdn.net https://*.daumcdn.net; "+
                "img-src 'self' data: https: https://dapi.kakao.com http://*.daumcdn.net https://*.daumcdn.net; " +
                "object-src 'none'; base-uri 'self'; form-action 'self';");
        res.setHeader("X-Content-Type-Options", "nosniff");
        res.setHeader("X-Frame-Options", "SAMEORIGIN");
        res.setHeader("X-Xss-Protection", "1; mode=block");
        res.setHeader("Access-Control-Allow-Methods", "GET, POST");
        res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");

        req.setCharacterEncoding("UTF-8");
        String uri = req.getRequestURI();
        String method = req.getMethod().toUpperCase();

        if (uri.contains(".well-known") || uri.contains("com.chrome.devtools.json")) {
            res.setStatus(HttpServletResponse.SC_OK);
            res.setContentType("application/json");
            res.setCharacterEncoding("UTF-8");
            res.getWriter().write("{\"status\": \"ok\", \"message\": \"Chrome DevTools auto request ignored\"}");
            return;
        }

        // 1) 위험한 HTTP 메소드 차단
        if ("PUT".equals(method) || "DELETE".equals(method) ||
                "OPTIONS".equals(method) || "TRACE".equals(method)) {
            res.sendError(404);
            return;
        }

        // 2) Axis2 AdminService 차단
        if (uri.contains("axis2")) {
            res.sendError(404);
            return;
        }

        // 3) Dreamweaver _mmServerScripts 폴더 차단
        if (uri.contains("_mmServerScripts")) {
            res.sendError(404);
            return;
        }

        if (uri.contains("Connections")) {
            res.sendError(404);
            return;
        }

        if (uri.contains("etc")) {
            res.sendError(404);
            return;
        }

        chain.doFilter(request, response);

    }

    @Override
    public void destroy() {
        log.info("End Method checking");
    }

}
