#!/usr/bin/env bash
# Fixture: tudo verde, exceto o X-Frame-Options no portal — o gate efetivo tem de falhar.
set -u

url="${@: -1}"

if [[ " $* " == *" -I "* || " $* " == *" -fsSI "* ]]; then
    case "$url" in
        */noticias/embed/*)
            printf 'HTTP/1.1 200 OK\r\nContent-Security-Policy: default-src '\''self'\''; frame-ancestors *\r\n\r\n'
            ;;
        */login)
            printf 'HTTP/1.1 200 OK\r\nContent-Security-Policy: default-src '\''self'\''; require-trusted-types-for '\''script'\''\r\nX-Frame-Options: SAMEORIGIN\r\nPermissions-Policy: geolocation=(), camera=(), microphone=(), payment=(), usb=()\r\nX-XSS-Protection: 0\r\n\r\n'
            ;;
        */build/assets/*)
            printf 'HTTP/1.1 200 OK\r\nCache-Control: public, max-age=31536000, immutable\r\n\r\n'
            ;;
        *)
            printf 'HTTP/1.1 200 OK\r\nContent-Security-Policy: default-src '\''self'\''; script-src '\''self'\'' https://www.vlibras.gov.br https://vlibras.gov.br https://www.googletagmanager.com; connect-src '\''self'\'' https://*.google-analytics.com https://www.googletagmanager.com; img-src '\''self'\'' data: https://*.google-analytics.com https://www.vlibras.gov.br\r\nPermissions-Policy: geolocation=(), camera=(), microphone=(), payment=(), usb=()\r\nX-XSS-Protection: 0\r\n\r\n'
            ;;
    esac
else
    printf '<!doctype html><script src="/build/assets/app-abc.js"></script>'
fi