<?php
declare(strict_types=1);

// Security headers (safe defaults; adjust CSP when you move to Tabler)
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: SAMEORIGIN');
header('Referrer-Policy: strict-origin-when-cross-origin');
header('Permissions-Policy: geolocation=(), microphone=(), camera=()');

// If you are fully HTTPS, consider enabling HSTS (commented by default)
// if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
//   header('Strict-Transport-Security: max-age=31536000; includeSubDomains; preload');
// }

// Basic CSP - permissive enough for legacy assets; tighten after UI modernization
// NOTE: If your current UI uses inline scripts/styles heavily, this may break.
// Keeping it minimal for now.
header("Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https:; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'self';");
