pub mod auth;
pub mod client_ip;
pub mod rate_limit;

pub use auth::jwt_auth_middleware;
pub use client_ip::{client_ip_middleware, ClientIp};
// `extract_client_ip` is `pub` in the client_ip module and used by its own
// tests; handlers consume the resolved IP via the `ClientIp` extractor instead.
pub use rate_limit::general_rate_limit_middleware;

// Simple security headers middleware
pub async fn security_headers_middleware(
    req: axum::extract::Request,
    next: axum::middleware::Next,
) -> axum::response::Response {
    let mut response = next.run(req).await;

    let headers = response.headers_mut();
    headers.insert("X-Content-Type-Options", "nosniff".parse().unwrap());
    headers.insert("X-Frame-Options", "DENY".parse().unwrap());
    headers.insert("X-XSS-Protection", "1; mode=block".parse().unwrap());
    headers.insert(
        "Strict-Transport-Security",
        "max-age=31536000; includeSubDomains".parse().unwrap(),
    );
    headers.insert(
        "Content-Security-Policy",
        "default-src 'self'".parse().unwrap(),
    );

    response
}
