middleware.ts

import { NextRequest, NextResponse } from "next/server";
import { LRUCache } from "lru-cache";
import { logRequest, logResponse, logError, normalizeRequestId } from "@/lib/logger";
import { generateRequestId, isValidRequestId } from "@/lib/requestId";
import { API_REQUEST_ID_HEADER } from "@/lib/api/headers";

// In-memory metrics store
const metrics: Record<string, { count: number; errorCount: number }> = {};

// ---------------------------------------------------------------------------
// CORS CONFIGURATION
// ---------------------------------------------------------------------------

const ALLOWED_ORIGINS: Set<string> = new Set(
  (process.env.ALLOWED_ORIGINS ?? "")
    .split(",")
    .map((o) => o.trim())
    .filter(Boolean)
);

const CORS_ALLOWED_METHODS = [
  "GET",
  "POST",
  "PUT",
  "DELETE",
  "PATCH",
  "OPTIONS",
];
const CORS_ALLOWED_HEADERS = [
  "Content-Type",
  "Authorization",
  API_REQUEST_ID_HEADER,
  "X-Requested-With",
];
const MAX_BODY_SIZE = parseInt(process.env.API_MAX_BODY_SIZE || "1048576", 10); // Default 1MB

// ---------------------------------------------------------------------------
// SECURITY HEADERS CONFIGURATION
// ---------------------------------------------------------------------------

// ---------------------------------------------------------------------------

/**
 * Applies Cross-Origin Resource Sharing (CORS) headers to the response if the request origin matches the configured allowlist.
 * Ensures the 'Vary' header is set to prevent CDN caching issues across different origins.
 * 
 * @param response The NextResponse object to set headers on
 * @param request The incoming NextRequest
 */
function applyCORS(response: NextResponse, request: NextRequest): void {
  const requestOrigin = request.headers.get("origin");

  // Always set Vary so intermediary caches don't collapse per-origin responses
  response.headers.set("Vary", "Origin");

  if (!requestOrigin || !ALLOWED_ORIGINS.has(requestOrigin)) {
    // Origin not in allowlist — omit ACAO entirely.
    // The browser will block the request; we do not need to explicitly deny.
    return;
  }

  response.headers.set("Access-Control-Allow-Origin", requestOrigin);
  response.headers.set("Access-Control-Allow-Credentials", "true");
  response.headers.set(
    "Access-Control-Allow-Methods",
    CORS_ALLOWED_METHODS.join(", "),
  );
  response.headers.set(
    "Access-Control-Allow-Headers",
    CORS_ALLOWED_HEADERS.join(", "),
  );
}

/**
 * Enforces standard security hardening headers to mitigate common clickjacking, XSS, and MIME-sniffing vulnerabilities.
 * 
 * @param response The NextResponse object to set headers on
 * @param nonce The securely generated random nonce for this request
 * @param isApiRoute Whether the request is for an API route
 */
function applySecurityHeaders(response: NextResponse, nonce: string, isApiRoute: boolean): void {
  response.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
  response.headers.set("X-Content-Type-Options", "nosniff");
  response.headers.set("X-Frame-Options", "DENY");
  response.headers.set("X-XSS-Protection", "1; mode=block");

  let csp = "";
  if (isApiRoute) {
    csp = "default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
  } else {
    csp = `default-src 'self'; script-src 'self' 'nonce-${nonce}' 'strict-dynamic'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; block-all-mixed-content; upgrade-insecure-requests;`.replace(/\s{2,}/g, " ").trim();
  }

  response.headers.set("Content-Security-Policy", csp);
}

/**
 * Validates that the request payload size is within the allowed bounds.
 * Reads content-length or parses request body buffer to determine size for POST/PUT/PATCH requests.
 * 
 * @param request The incoming NextRequest
 * @param maxSize The maximum allowed request body size in bytes
 * @returns An object containing validation status and optional 413 response on error
 */
async function validateBodySize(
  request: NextRequest,
  maxSize: number = MAX_BODY_SIZE,
): Promise<{ valid: boolean; error?: NextResponse }> {
  const methodsToValidate = ["POST", "PUT", "PATCH"];
  if (!methodsToValidate.includes(request.method)) {
    return { valid: true };
  }
  const contentLength = request.headers.get("content-length");
  if (contentLength && parseInt(contentLength, 10) > maxSize) {
    return {
      valid: false,
      error: new NextResponse(
        JSON.stringify({
          error: "Payload Too Large",
          message: `Request body exceeds maximum size of ${maxSize} bytes.`,
        }),
        {
          status: 413,
          headers: { "Content-Type": "application/json" },
        },
      ),
    };
  }
  if (!contentLength) {
    try {
      const bodyBuffer = await request.arrayBuffer();
      if (bodyBuffer.byteLength > maxSize) {
        return {
          valid: false,
          error: new NextResponse(
            JSON.stringify({
              error: "Payload Too Large",
              message: `Request body exceeds maximum size of ${maxSize} bytes.`,
            }),
            {
              status: 413,
              headers: { "Content-Type": "application/json" },
            },
          ),
        };
      }
    } catch {
      return { valid: true };
    }
  }
  return { valid: true };
}

// ---------------------------------------------------------------------------
// Rate limiting
// ---------------------------------------------------------------------------

const RATE_LIMITS = {
  auth: 10,
  write: 50,
  general: 100,
};
const rateLimitCache = new LRUCache<
  string,
  { count: number; expiresAt: number }
>({
  max: 10000,
  ttl: 60 * 1000,
});

// ---------------------------------------------------------------------------
// Middleware
// ---------------------------------------------------------------------------

/**
 * The main gateway middleware intercepting all `/api/:path*` requests.
 * Orchestrates requestId tracking, structured request logging, CORS, security headers, body size checks, and tiered rate limiting.
 * 
 * @param request The incoming NextRequest object
 * @returns A NextResponse mapping to the next middleware or a specific error response (e.g. 413, 429)
 */
export async function middleware(request: NextRequest) {
  const start = Date.now();
  const method = request.method;
  const url = request.nextUrl.pathname;
  const isApiRoute = url.startsWith("/api");
  const incomingRequestId = request.headers.get(API_REQUEST_ID_HEADER);
  const requestId =
    incomingRequestId && isValidRequestId(incomingRequestId)
      ? incomingRequestId
      : generateRequestId();

  const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
  const requestHeaders = new Headers(request.headers);
  requestHeaders.set("x-nonce", nonce);

  // Extract IP or fallback for key
  const forwardedFor = request.headers.get("x-forwarded-for");
  let ip = "127.0.0.1";
  if (forwardedFor) {
    ip = forwardedFor.split(",")[0].trim();
  } else {
    const remoteAddr = request.headers.get("x-real-ip");
    if (remoteAddr) {
      ip = remoteAddr;
    }
  }

  // Whitelist test environments (Playwright E2E)
  if (
    request.headers.get("x-playwright-test") === "true" &&
    process.env.NODE_ENV !== "production"
  ) {
    return NextResponse.next();
  }

  // Whitelist Health Check
  if (url === "/api/health" || url.startsWith("/api/health/")) {
    return NextResponse.next();
  }

  // Log incoming request (only for /api/* routes)
  if (isApiRoute) {
    const headersObj: Record<string, string> = {};
    request.headers.forEach((value, key) => {
      headersObj[key] = value;
    });
    logRequest(requestId, method, url, headersObj);
  }

  let apiResponse: NextResponse;
  let statusCode = 200;

  apiResponse = NextResponse.next({
    request: {
      headers: requestHeaders,
    },
  });

  // Apply CORS only for API routes, apply security headers for all routes
  if (isApiRoute) {
    applyCORS(apiResponse, request);
  }
  applySecurityHeaders(apiResponse, nonce, isApiRoute);

  // Handle CORS OPTIONS preflight requests (only relevant for API)
  if (isApiRoute && method === "OPTIONS") {
    const preflightResponse = new NextResponse(null, { status: 204 });
    applyCORS(preflightResponse, request);
    applySecurityHeaders(preflightResponse, nonce, isApiRoute);
    return preflightResponse;
  }

  // Validate request body size (only for API)
  if (isApiRoute) {
    const bodySizeValidation = await validateBodySize(request);
    if (!bodySizeValidation.valid && bodySizeValidation.error) {
      applyCORS(bodySizeValidation.error, request);
      applySecurityHeaders(bodySizeValidation.error, nonce, isApiRoute);
      return bodySizeValidation.error;
    }
  }

  // Rate limiting (only for API routes)
  if (isApiRoute) {
    let limit = RATE_LIMITS.general;
    let limitType = "general";
    if (url.startsWith("/api/auth/")) {
      limit = RATE_LIMITS.auth;
      limitType = "auth";
    } else if (["POST", "PUT", "DELETE", "PATCH"].includes(method)) {
      limit = RATE_LIMITS.write;
      limitType = "write";
    }
    const cacheKey = `${ip}:${limitType}`;
    const now = Date.now();
    const tokenRecord = rateLimitCache.get(cacheKey) || {
      count: 0,
      expiresAt: now + 60000,
    };
    if (now > tokenRecord.expiresAt) {
      tokenRecord.count = 0;
      tokenRecord.expiresAt = now + 60000;
    }
    tokenRecord.count += 1;
    rateLimitCache.set(cacheKey, tokenRecord);
    if (tokenRecord.count > limit) {
      const retryAfter = Math.ceil(
        (tokenRecord.expiresAt - now) / 1000,
      ).toString();
      const rateLimitError = new NextResponse(
        JSON.stringify({
          error: "Too Many Requests",
          message: "Rate limit exceeded.",
        }),
        {
          status: 429,
          headers: {
            "Content-Type": "application/json",
            "Retry-After": retryAfter,
            "X-RateLimit-Limit": limit.toString(),
            "X-RateLimit-Remaining": "0",
            "X-RateLimit-Reset": tokenRecord.expiresAt.toString(),
          },
        },
      );
      applyCORS(rateLimitError, request);
      applySecurityHeaders(rateLimitError, nonce, isApiRoute);
      const durationMs = Date.now() - start;
      const key = `${method} ${url}`;
      if (!metrics[key]) metrics[key] = { count: 0, errorCount: 0 };
      metrics[key].count++;
      metrics[key].errorCount++;
      logResponse(requestId, method, url, 429, durationMs);
      rateLimitError.headers.set("X-Request-ID", requestId);
      return rateLimitError;
    }

    // Add rate limit headers to response
    apiResponse.headers.set("X-RateLimit-Limit", limit.toString());
    apiResponse.headers.set(
      "X-RateLimit-Remaining",
      (limit - tokenRecord.count).toString(),
    );
    apiResponse.headers.set(
      "X-RateLimit-Reset",
      tokenRecord.expiresAt.toString(),
    );

    // Log response
    const durationMs = Date.now() - start;
    const key = `${method} ${url}`;
    if (!metrics[key]) metrics[key] = { count: 0, errorCount: 0 };
    metrics[key].count++;
    if (statusCode >= 400) metrics[key].errorCount++;
    logResponse(requestId, method, url, statusCode, durationMs);
  }

  apiResponse.headers.set("X-Request-ID", requestId);

  return apiResponse;
}

export { metrics };

export const config = {
  matcher: [
    "/((?!_next/static|_next/image|favicon.ico).*)",
  ],
};