/** @type {import('next').NextConfig} */
const securityHeaders = [
  // Baseline security headers. CSP and rate limiting for dynamic routes
  // live in src/proxy.ts, since CSP needs a per-request nonce.
  { key: 'X-Content-Type-Options', value: 'nosniff' },
  { key: 'X-Frame-Options', value: 'DENY' },
  { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
  { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
  { key: 'X-DNS-Prefetch-Control', value: 'on' },
];

const nextConfig = {
  reactStrictMode: true,

  images: {
    // IGDB/RAWG serve cover art and screenshots from these CDNs.
    // Keep this list tight and add sources deliberately, don't use '*'.
    remotePatterns: [
      { protocol: 'https', hostname: 'images.igdb.com' },
      { protocol: 'https', hostname: 'media.rawg.io' },
    ],
    formats: ['image/avif', 'image/webp'],
  },

  async headers() {
    return [
      {
        source: '/:path*',
        headers: securityHeaders,
      },
      {
        // Generated pages are static-ish; let CDNs cache them, but always
        // revalidate so a quality-gate takedown (via config/overrides.json)
        // propagates quickly instead of being stuck in cache.
        source: '/games/:slug*',
        headers: [
          { key: 'Cache-Control', value: 'public, max-age=0, s-maxage=3600, stale-while-revalidate=86400' },
        ],
      },
    ];
  },

  async redirects() {
    return [];
  },

  eslint: {
    ignoreDuringBuilds: false,
  },
};

export default nextConfig;
