class SecureHeaders::Middleware

# File lib/secure_headers/middleware.rb, line 4
def initialize(app)
  @app = app
end

# File lib/secure_headers/middleware.rb, line 9
def call(env)
  req = Rack::Request.new(env)
  status, headers, response = @app.call(env)

  # Rack::Headers is available in Rack 3.x and later
  # So we should pull the headers into that structure if possible
  if defined?(Rack::Headers)
    headers = Rack::Headers[headers]
  end

  config = SecureHeaders.config_for(req)
  flag_cookies!(headers, override_secure(env, config.cookies)) unless config.cookies == OPT_OUT
  headers.merge!(SecureHeaders.header_hash_for(req))
  [status, headers, response]
end

# File lib/secure_headers/middleware.rb, line 28
def flag_cookies!(headers, config)
  cookies = headers["Set-Cookie"]
  return unless cookies

  cookies_array = cookies.is_a?(Array) ? cookies : cookies.split("\n")
  secured_cookies = cookies_array.map { |cookie| SecureHeaders::Cookie.new(cookie, config).to_s }
  headers["Set-Cookie"] = cookies.is_a?(Array) ? secured_cookies : secured_cookies.join("\n")
end

# File lib/secure_headers/middleware.rb, line 38
def override_secure(env, config = {})
  if scheme(env) != "https" && config != OPT_OUT
    config[:secure] = OPT_OUT
  end

  config
end

# File lib/secure_headers/middleware.rb, line 47
def scheme(env)
  if env["HTTPS"] == "on" || env["HTTP_X_SSL_REQUEST"] == "on"
    "https"
  elsif env["HTTP_X_FORWARDED_PROTO"]
    env["HTTP_X_FORWARDED_PROTO"].split(",")[0]
  else
    env["rack.url_scheme"]
  end
end