class SecurityHeadersMiddleware:
    """
    Adds strict security headers required by SEO tools and modern web standards.
    """
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        response = self.get_response(request)
        
        # Content Security Policy (CSP)
        # Allows self, data:, fonts, cloudflare, GA4, and basic inline styles/scripts
        csp = (
            "default-src 'self'; "
            "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com; "
            "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; "
            "font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com; "
            "img-src 'self' data: https://www.google-analytics.com; "
            "connect-src 'self' https://www.google-analytics.com https://region1.google-analytics.com; "
            "frame-src 'self' https://www.youtube.com https://player.vimeo.com;"
        )
        response['Content-Security-Policy'] = csp
        
        # Permissions Policy (replaces Feature-Policy)
        # Disables camera, microphone, geolocation, and other invasive APIs
        permissions_policy = (
            "accelerometer=(), "
            "camera=(), "
            "geolocation=(), "
            "gyroscope=(), "
            "magnetometer=(), "
            "microphone=(), "
            "payment=(), "
            "usb=()"
        )
        response['Permissions-Policy'] = permissions_policy
        
        # Strict Transport Security (HSTS)
        # Only added in production to prevent local dev lockout
        from django.conf import settings
        if not settings.DEBUG:
            response['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains; preload'
            
        return response