app = FastAPI(title=settings.APP_NAME, lifespan=lifespan,
              docs_url="/api/docs", openapi_url="/api/openapi.json")


class SecurityHeadersMiddleware(BaseHTTPMiddleware):
    async def dispatch(self, request, call_next):
        response = await call_next(request)
        response.headers.setdefault("X-Content-Type-Options", "nosniff")
        response.headers.setdefault("X-Frame-Options", "DENY")
        response.headers.setdefault("Referrer-Policy", "no-referrer")
        response.headers.setdefault("Content-Security-Policy",
                                    "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline';"
                                    " script-src 'self'; frame-ancestors 'none'")
        if settings.ENVIRONMENT == "production":
            response.headers.setdefault("Strict-Transport-Security", "max-age=63072000; includeSubDomains")
        return response


app.add_middleware(SecurityHeadersMiddleware)

app.include_router(auth.router)
app.include_router(accounts.router)
app.include_router(recipients.router)
app.include_router(subjects.router)
app.include_router(templates.router)
app.include_router(attachments.router)
app.include_router(phones.router)
app.include_router(campaigns.router)
app.include_router(test_send.router)
app.include_router(dashboard.router)
app.include_router(suppression.router)
app.include_router(settings_router.router)
app.include_router(logs.router)
app.include_router(unsub_router.router)