# Static server for the embeddable widget JS bundle.
# Customer sites fetch this file cross-origin via <script src="...">,
# which doesn't strictly require CORS headers for *executing* the script,
# but we set them anyway in case anyone fetches it via XHR/fetch (e.g. for SRI).
#
# Cache-Control: 5 minutes — short enough that we can ship updates without
# customers needing to re-embed, long enough to avoid hammering origin.

server {
    listen 80;
    server_name _;

    root /usr/share/nginx/html;
    server_tokens off;

    # Security headers (Finding 9 of the SEO audit) — applied to ALL responses
    # including errors via `always`. nginx gotcha: `add_header` does NOT
    # inherit into a location that defines its OWN `add_header`. The three
    # headers below are re-declared inside every location that has its own
    # add_header (= /aiw-voice-widget.js, = /_health). The `location /` block
    # has no add_header and inherits cleanly.
    add_header X-Content-Type-Options "nosniff"                          always;
    add_header X-Frame-Options        "SAMEORIGIN"                       always;
    add_header Referrer-Policy        "strict-origin-when-cross-origin"  always;

    gzip on;
    gzip_vary on;
    gzip_types application/javascript text/javascript;
    gzip_min_length 1024;

    # The widget bundle.
    location = /aiw-voice-widget.js {
        # CORS preflight (extremely rare for a <script> tag, harmless to handle).
        if ($request_method = OPTIONS) {
            add_header Access-Control-Allow-Origin  "*";
            add_header Access-Control-Allow-Methods "GET, OPTIONS";
            add_header Access-Control-Max-Age       86400;
            add_header Content-Length 0;
            add_header Content-Type text/plain;
            return 204;
        }

        add_header Access-Control-Allow-Origin  "*"             always;
        add_header Access-Control-Allow-Methods "GET, OPTIONS"  always;
        add_header Cache-Control                "public, max-age=300" always;
        add_header Content-Type                 "application/javascript; charset=utf-8" always;
        # Re-declare security headers (nginx inheritance loses them here).
        add_header X-Content-Type-Options       "nosniff"                          always;
        add_header X-Frame-Options              "SAMEORIGIN"                       always;
        add_header Referrer-Policy              "strict-origin-when-cross-origin"  always;
        try_files $uri =404;
    }

    # Liveness probe.
    location = /_health {
        access_log off;
        return 200 "ok\n";
        add_header Content-Type text/plain;
        # Re-declare security headers (nginx inheritance loses them here).
        add_header X-Content-Type-Options "nosniff"                          always;
        add_header X-Frame-Options        "SAMEORIGIN"                       always;
        add_header Referrer-Policy        "strict-origin-when-cross-origin"  always;
    }

    # Anything else: 404. We only serve the one file.
    location / {
        return 404;
    }
}