import type { NextConfig } from "next";

const nextConfig: NextConfig = {
  // Compress responses for faster delivery (better Core Web Vitals → better ranking)
  compress: true,

  // Power-user images: allow Next.js to serve them with optimal formats
  images: {
    formats: ["image/avif", "image/webp"],
  },

  async headers() {
    return [
      // Global security + SEO headers applied to every route
      {
        source: "/(.*)",
        headers: [
          // Don't leak referrer data to third parties
          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
          // Prevent MIME-type sniffing
          { key: "X-Content-Type-Options", value: "nosniff" },
          // Stop clickjacking
          { key: "X-Frame-Options", value: "SAMEORIGIN" },
          // Basic XSS protection for legacy browsers
          { key: "X-XSS-Protection", value: "1; mode=block" },
          // Force HTTPS for 1 year once visited
          {
            key: "Strict-Transport-Security",
            value: "max-age=31536000; includeSubDomains; preload",
          },
          // Allow geolocation + media for legitimate use; block unused attack vectors
          {
            key: "Permissions-Policy",
            value: "camera=(), microphone=(), geolocation=(self), interest-cohort=()",
          },
        ],
      },
      // Private pages: tell crawlers not to index them
      {
        source: "/wallet(.*)",
        headers: [{ key: "X-Robots-Tag", value: "noindex, nofollow" }],
      },
      {
        source: "/api/(.*)",
        headers: [{ key: "X-Robots-Tag", value: "noindex, nofollow" }],
      },
      {
        source: "/vote(.*)",
        headers: [{ key: "X-Robots-Tag", value: "noindex, nofollow" }],
      },
      // Static assets: long-lived cache
      {
        source: "/_next/static/(.*)",
        headers: [
          { key: "Cache-Control", value: "public, max-age=31536000, immutable" },
        ],
      },
    ];
  },

  async redirects() {
    return [
      // Canonical: redirect www → non-www (or flip this if your domain is www-first)
      {
        source: "/(.*)",
        has: [{ type: "host", value: "www.democracyrising.org" }],
        destination: "https://democracyrising.org/:path*",
        permanent: true,
      },
    ];
  },
};

export default nextConfig;