# frozen_string_literal: true

module Admin
  class BaseController < ApplicationController
    include Authorization
    include AccountableConcern
    include Admin::PermissionsConcern

    content_security_policy do |p|
      policy = ContentSecurityPolicy.new
      p.img_src(*p.img_src, *policy.admin_media_hosts)
      p.media_src(*p.media_src, *policy.admin_media_hosts)
    end

    layout 'admin'

    before_action :set_referrer_policy_header

    after_action :verify_authorized

    private

    def set_referrer_policy_header
      response.headers['Referrer-Policy'] = 'same-origin'
    end

    def set_user
      @user = Account.find(params[:account_id]).user || raise(ActiveRecord::RecordNotFound)
    end
  end
end