export async function registerSecurityHeaders(fastify) {
  fastify.addHook('onSend', async (request, reply) => {
    reply.header('X-Content-Type-Options', 'nosniff')
    reply.header('X-Frame-Options', 'DENY')
    reply.header('X-XSS-Protection', '0')
    reply.header('Referrer-Policy', 'strict-origin-when-cross-origin')
    reply.header('Permissions-Policy', 'camera=(), microphone=(), geolocation=()')

    const cspDirectives = [
      "default-src 'self'",
      "script-src 'self' https://*.yookassa.ru https://*.vk.com https://oauth.yandex.ru",
      "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
      "img-src 'self' data: blob: https://tile.openstreetmap.org https://*.yookassa.ru https://*.vk.com https://oauth.yandex.ru",
      "font-src 'self' https://fonts.gstatic.com",
      "connect-src 'self' https://*.yookassa.ru https://*.vk.com https://oauth.yandex.ru",
      'frame-src https://*.yookassa.ru',
      "object-src 'none'",
      "base-uri 'self'",
      "form-action 'self'",
    ].join('; ')

    reply.header('Content-Security-Policy', cspDirectives)
  })
}