"use strict";
/*
 * @adonisjs/shield
 *
 * (c) Harminder Virk <virk@adonisjs.com>
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.frameGuardFactory = void 0;
const noop_1 = require("./noop");
const ALLOWED_ACTIONS = ['DENY', 'ALLOW-FROM', 'SAMEORIGIN'];
/**
 * Factory function that returns a function to set `X-Frame-Options` header
 * based upon given user options.
 */
function frameGuardFactory(options) {
    if (!options.enabled) {
        return noop_1.noop;
    }
    const action = (options.action || 'SAMEORIGIN').toUpperCase();
    if (!ALLOWED_ACTIONS.includes(action)) {
        throw new Error('frameGuard: Action must be one of "DENY", "ALLOW-FROM" or "SAMEORGIGIN"');
    }
    if (action === 'ALLOW-FROM' && !options['domain']) {
        throw new Error('frameGuard: Domain value is required when using action as "ALLOW-FROM"');
    }
    const result = action === 'ALLOW-FROM' ? `${action} ${options['domain']}` : action;
    return function frameGuard({ response }) {
        response.header('X-Frame-Options', result);
    };
}
exports.frameGuardFactory = frameGuardFactory;
