lib/source_app_middleware.rb
# frozen_string_literal: true

class SourceAppMiddleware
  MODULES_APP_NAMES = Set.new %w[
    appeals_api
    apps_api
    claims_api
    coronavirus-research
    mobile
    openid_auth
    test_user_dashboard
  ].freeze

  OTHER_APP_NAMES = Set.new %w[
    unknown
    undefined
  ].freeze

  # NOTE: Corresponds to the HTTP_SOURCE_APP_NAME header
  # Allowlist of vets-website app names. List was generated by running
  # `yarn apps` or `npm run apps` from inside the vets-website dir
  FRONT_END_APP_NAMES = Set.new [
    '0247-pmc',
    '0845-auth-disclose',
    '0993-edu-benefits',
    '0994-edu-benefits',
    '0996-higher-level-review',
    '10-10D',
    '1010cg-application-caregiver-assistance',
    '10182-board-appeal',
    '10203-edu-benefits',
    '10206-pa',
    '10207-pp',
    '10210-lay-witness-statement',
    '10-7959a',
    '10-7959C',
    '10-7959f-1-FMP',
    '1330m2-medallions',
    '1330m-medallions',
    '1990-edu-benefits',
    '1990e-edu-benefits',
    '1990ez-edu-benefits',
    '1990n-edu-benefits',
    '1990s-edu-benefits',
    '1995-edu-benefits',
    '21-0966-intent-to-file-a-claim',
    '21-0972-alternate-signer',
    '21-4142-medical-release',
    '21p-0537',
    '21P-0847-substitute-claimant',
    '25-8832-planning-and-career-guidance',
    '28-1900-chapter-31',
    '4555-adapted-housing',
    '526EZ-all-claims',
    '5490-edu-benefits',
    '5495-edu-benefits',
    '686C-674',
    '686C-674-v2',
    '995-supplemental-claim',
    'appeals-testing',
    'appoint-a-representative',
    'ask-a-question',
    'ask-va',
    'auth',
    'avs',
    'burial-poc-v6',
    'burials',
    'burials-v2',
    'burials-ez',
    'chatbot',
    'check-in',
    'claims-status',
    'coe',
    'coe-status',
    'combined-debt-portal',
    'coronavirus-research',
    'coronavirus-research-update',
    'covid19screen',
    'dashboard',
    '0538-dependents-verification',
    'dependents-view-dependents',
    'dhp-consent-flow',
    'discharge-upgrade-instructions',
    'discover-your-benefits',
    'dispute-debt',
    'ds-playground',
    'ds-v3-playground',
    'education-letters',
    'enrollment-verification',
    'ezr',
    'facilities',
    'feedback-tool',
    'find-a-representative',
    'fmp-cover-sheet',
    'fry-dea',
    'gi',
    'hca',
    'health-care-supply-reordering',
    'income-and-asset-statement',
    'income-limits',
    'letters',
    'login-page',
    'medical-copays',
    'medical-records',
    'medications',
    'messages',
    'mhv-inherited-proofing',
    'mhv-landing-page',
    'mhv-secure-messaging',
    'mhv-secure-messaging-pilot',
    'mock-alternate-header-0845',
    'mock-form',
    'mock-form-patterns-v3',
    'mock-simple-forms-patterns',
    'mock-sip-form',
    'my-documents',
    'notification-center',
    'office-directory',
    'order-form-2346',
    'pact-act',
    'pensions',
    'post-911-gib-status',
    'pre-check-in',
    'pre-need',
    'pre-need-integration',
    'profile',
    'proxy-rewrite',
    'public-outreach-materials',
    'rated-disabilities',
    'representative',
    'representative-form-upload',
    'representative-21a',
    'request-debt-help-form-5655',
    'resources-and-support',
    'sahg',
    'search',
    'search-representative',
    'secure-messaging',
    'secure-messaging-pilot',
    'sign-in-changes',
    'Survivor and Dependent Benefits 22-5490',
    'survivor-dependent-education-benefit-22-5490',
    'static-pages',
    'submitted-appeal',
    'terms-of-use',
    'toe',
    'travel-claim',
    'travel-pay',
    'vaos',
    'verify',
    'verify-your-enrollment',
    'veteran-id-card',
    'view-payments',
    'view-representative',
    'virtual-agent',
    'welcome-va-setup-review-information',
    'yellow-ribbon',
    'your-debt'
  ].freeze

  MOBILE_APP_NAMES = Set.new %w[
    va-health-benefits-app
  ].freeze

  SOURCE_APP_NAMES = FRONT_END_APP_NAMES + MOBILE_APP_NAMES + MODULES_APP_NAMES + OTHER_APP_NAMES

  def initialize(app)
    @app = app
  end

  def call(env)
    source_app = env['HTTP_SOURCE_APP_NAME']

    if source_app.nil?
      source_app = 'not_provided'
    elsif SOURCE_APP_NAMES.exclude?(source_app)
      # TODO: - Use sentry to notify us instead. It must be done in a rate-limited way
      #        so as not to allow for a malicious client to overflow worker queues
      Rails.logger.warn "Unrecognized value for HTTP_SOURCE_APP_NAME request header... [#{source_app}]"
      source_app = 'not_in_allowlist'
    end

    env['SOURCE_APP'] = source_app
    @app.call(env)
  end
end
