import time
from django.http import HttpResponseForbidden
from django.core.cache import cache


class SEOMiddleware:
    """Add SEO headers and security headers to all responses"""

    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        response = self.get_response(request)

        # Security Headers
        response['Referrer-Policy'] = 'strict-origin-when-cross-origin'
        response['Permissions-Policy'] = 'geolocation=(), microphone=(), camera=()'

        # Prevent MIME sniffing
        response['X-Content-Type-Options'] = 'nosniff'

        return response


class RateLimitMiddleware:
    """Rate limiting for contact form"""

    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        if request.path == '/contact/' and request.method == 'POST':
            ip = self.get_client_ip(request)
            key = f'rate_limit_{ip}'
            attempts = cache.get(key, 0)

            if attempts >= 5:
                return HttpResponseForbidden('Too many requests. Please try again later.')

            cache.set(key, attempts + 1, timeout=3600)  # 1 hour

        return self.get_response(request)

    def get_client_ip(self, request):
        x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
        if x_forwarded_for:
            return x_forwarded_for.split(',')[0].strip()
        return request.META.get('REMOTE_ADDR')