// The third-party hosts each TravelpayoutsWidget kind loads, per CSP directive. A site rendering a kind must allow
// these in its Content-Security-Policy (scripts/validate-csp-coverage.mjs checks the built site against this list).
// Read from each loader's own code: the tpwdg.com/c91 loader script, then what it injects (scripts, frames,
// stylesheets), and the hosts they fetch from (connect-src), traced in a browser (SLA-2920). A quoted CSP keyword
// ('unsafe-eval') is a requirement too: the hotel loader evals, and without it renders a static fallback card.
// Every other component in this folder loads nothing: its outbound links are caller data, not resources.
// Plain data and erasable types only: the gate imports this file under Node.

import type { WidgetLoader } from '@sarimarcus/content-sites-core/affiliate';

export type WidgetKind = 'hotel' | 'activity' | 'train' | 'car';
export type CspDirective = 'script-src' | 'frame-src' | 'style-src' | 'connect-src';
export type WidgetResources = Partial<Record<CspDirective, readonly string[]>>;

export const externalResources: Record<WidgetKind, WidgetResources> = {
  hotel: {
    'script-src': ['https://tpwdg.com', "'unsafe-eval'"],
    'connect-src': ['https://suggest.apistp.com', 'https://avsplow.com', 'https://sentry.avs.io'],
  },
  activity: {
    'script-src': ['https://tpwdg.com', 'https://widget.getyourguide.com'],
    'frame-src': ['https://widget.getyourguide.com'],
    'connect-src': ['https://tpo.gg', 'https://widget.getyourguide.com'],
  },
  train: {
    'script-src': ['https://c91.travelpayouts.com', 'https://www.omio.com'],
    'style-src': ['https://www.omio.com'],
    'connect-src': ['https://tpo.gg', 'https://api.omio.com'],
  },
  car: {
    'script-src': ['https://tpwdg.com', 'https://www.discovercars.com'],
    'frame-src': ['https://widget.discovercars.com'],
    'connect-src': ['https://tpo.gg'],
  },
};


/**
 * Each kind's loader script and the ids its URL reports under (SLA-2919). `promoId` is also how
 * scripts/validate-csp-coverage.mjs recognises a widget in a built page that carries no `data-affiliate-widget` marker.
 */
export const widgetLoaders: Record<WidgetKind, WidgetLoader> = {
  hotel: { url: 'https://tpwdg.com/content', promoId: '2693', campaignId: '84' },
  activity: { url: 'https://tpwdg.com/content', promoId: '4039', campaignId: '108' },
  train: { url: 'https://c91.travelpayouts.com/content', promoId: '4770' },
  car: { url: 'https://tpwdg.com/content', promoId: '3873', campaignId: '117' },
};

/** The Travelpayouts Emerald loader every page carries (EmeraldLoader): https://emrldtp.com/<base64 trs>.js?t=<trs>. */
export const EMERALD_ORIGIN = 'https://emrldtp.com';

/** Hosts the Emerald loader fetches adv_out.js from (connect-src); the network rotates them. */
export const EMERALD_CONNECT_ORIGINS = ['https://mn-tz.com', 'https://emrld.cc'] as const;

export const emeraldResources: Partial<Record<CspDirective, readonly string[]>> = {
  'script-src': [EMERALD_ORIGIN],
  'connect-src': [EMERALD_ORIGIN, ...EMERALD_CONNECT_ORIGINS],
};