next.config.ts

import createNextIntlPlugin from "next-intl/plugin";
import type { Configuration } from "webpack";

const withNextIntl = createNextIntlPlugin();

// Temporarily disabling next-pwa as the installed version (2.0.2) is incompatible with Next.js 16
// and is missing the required 'cache' submodule.
/*
const defaultCache = require("next-pwa/cache");
const withPWA = require("next-pwa")({
  dest: "public",
  disable: process.env.NODE_ENV === "development",
  register: true,
  skipWaiting: true,
  fallbacks: {
    document: "/fr/offline",
  },
  runtimeCaching: [
    {
      urlPattern: /^\/api\/public\/cars/,
      handler: "StaleWhileRevalidate",
      options: {
        cacheName: "cars-api-cache",
        expiration: {
          maxEntries: 50,
          maxAgeSeconds: 24 * 60 * 60,
        },
      },
    },
    ...defaultCache,
  ],
});
*/

const GLB_GLTF_REGEX = /\.(glb|gltf)$/;

const nextConfig = {
  output: "standalone",
  typescript: {
    ignoreBuildErrors: false,
  },
  images: {
    remotePatterns: [
      {
        protocol: "https",
        hostname: "**.supabase.co",
        pathname: "/storage/v1/object/public/**",
      },
      {
        protocol: "https",
        hostname: "lh3.googleusercontent.com",
      },
      {
        protocol: "https",
        hostname: "images.unsplash.com",
      },
      {
        protocol: "https",
        hostname: "loremflickr.com",
      },
    ],
  },
  // Webpack config for 3D models
  webpack: (config: Configuration) => {
    if (config.module?.rules) {
      config.module.rules.push({
        test: GLB_GLTF_REGEX,
        // biome-ignore lint/suspicious/noExplicitAny: webpack asset/resource type requires cast
        type: "asset/resource" as any,
      });
    }
    return config;
  },
  headers() {
    const supabaseUrl =
      process.env.NEXT_PUBLIC_SUPABASE_URL || "https://*.supabase.co";
    const supabaseDomain = supabaseUrl.replace("https://", "");

    const cspDirectives = [
      "default-src 'self'",
      `script-src 'self' 'unsafe-inline' ${process.env.NODE_ENV === "development" ? "'unsafe-eval'" : ""} https://www.googletagmanager.com https://www.google-analytics.com https://maps.googleapis.com`,
      "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
      `img-src 'self' data: blob: ${supabaseUrl} https://*.supabase.co https://images.unsplash.com https://loremflickr.com https://maps.googleapis.com https://maps.gstatic.com https://www.googletagmanager.com https://lh3.googleusercontent.com`,
      "font-src 'self' https://fonts.gstatic.com data:",
      `connect-src 'self' ${supabaseUrl} https://*.supabase.co wss://${supabaseDomain} https://www.google-analytics.com https://api.chutes.ai https://maps.googleapis.com`,
      "frame-src 'self' https://www.google.com https://maps.google.com",
      `media-src 'self' ${supabaseUrl} https://*.supabase.co blob:`,
      "object-src 'none'",
      "base-uri 'self'",
      "form-action 'self'",
      "frame-ancestors 'self'",
      "worker-src 'self' blob:",
      "manifest-src 'self'",
    ].join("; ");

    return [
      {
        source: "/api/:path*",
        headers: [
          {
            key: "Access-Control-Allow-Origin",
            value: process.env.ALLOWED_ORIGIN || "*",
          },
          {
            key: "Access-Control-Allow-Methods",
            value: "GET, POST, PUT, DELETE, OPTIONS",
          },
          {
            key: "Access-Control-Allow-Headers",
            value: "Content-Type, Authorization, X-Requested-With",
          },
          { key: "Access-Control-Max-Age", value: "86400" },
          {
            key: "Cache-Control",
            value: "no-store, no-cache, must-revalidate",
          },
        ],
      },
      {
        source: "/:path*",
        headers: [
          { key: "Content-Security-Policy", value: cspDirectives },
          { key: "X-DNS-Prefetch-Control", value: "on" },
          { key: "X-Frame-Options", value: "SAMEORIGIN" },
          { key: "X-Content-Type-Options", value: "nosniff" },
          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
          { key: "X-XSS-Protection", value: "1; mode=block" },
          {
            key: "Strict-Transport-Security",
            value: "max-age=31536000; includeSubDomains; preload",
          },
          {
            key: "Permissions-Policy",
            value:
              "camera=(), microphone=(), geolocation=(self), interest-cohort=()",
          },
          { key: "Cross-Origin-Opener-Policy", value: "same-origin" },
        ],
      },
    ];
  },
};

// biome-ignore lint/suspicious/noExplicitAny: withNextIntl wrapping requires cast
export default withNextIntl(nextConfig as any);