<?php

declare(strict_types=1);

namespace OCA\Mitgliederverwaltung\Middleware;

use OCP\AppFramework\Http\DownloadResponse;
use OCP\AppFramework\Http\Response;
use OCP\AppFramework\Middleware;

/**
 * Adds security headers to download responses.
 *
 * Ensures all file download responses include:
 * - X-Content-Type-Options: nosniff (prevents MIME-type sniffing)
 *
 * Content-Disposition: attachment is already set by Nextcloud's
 * DownloadResponse class.
 *
 * Part of Issue #173.
 */
class SecurityHeadersMiddleware extends Middleware {

    /**
     * Add security headers after the controller action returns a response.
     */
    public function afterController($controller, $methodName, Response $response): Response {
        if ($response instanceof DownloadResponse) {
            $response->addHeader('X-Content-Type-Options', 'nosniff');
        }

        return $response;
    }
}
