<?php

declare(strict_types=1);

namespace BattleForge\Http;

final class Response
{
    private const SECURITY_HEADERS = [
        'X-Content-Type-Options' => 'nosniff',
        'Referrer-Policy' => 'same-origin',
        'Content-Security-Policy' => "default-src 'self'; img-src 'self' data:; style-src 'self'",
    ];

    /** @param array<string, string> $headers */
    public function __construct(
        public int $status,
        public array $headers,
        public string $body,
    ) {
    }

    public static function html(int $status, string $body): self
    {
        return new self(
            $status,
            ['Content-Type' => 'text/html; charset=utf-8'] + self::SECURITY_HEADERS,
            $body,
        );
    }

    public static function json(int $status, mixed $body): self
    {
        return new self(
            $status,
            ['Content-Type' => 'application/json; charset=utf-8'] + self::SECURITY_HEADERS,
            json_encode($body, JSON_THROW_ON_ERROR),
        );
    }

    public static function redirect(string $location, int $status = 303): self
    {
        return new self(
            $status,
            ['Location' => $location] + self::SECURITY_HEADERS,
            '',
        );
    }
}