> yuAs69Bots

# Mute progressif selon le nombre de recidives detectees par l'IA.
# Index 0 = 1ere offense, index 8 = 9eme offense et plus.
OFFENSE_TIMEOUTS_SECONDS = [
    5  * 60,           # 1ere   : 5 min
    15 * 60,           # 2eme   : 15 min
    30 * 60,           # 3eme   : 30 min
    2  * 3600,         # 4eme   : 2 h
    6  * 3600,         # 5eme   : 6 h
    12 * 3600,         # 6eme   : 12 h
    24 * 3600,         # 7eme   : 24 h
    48 * 3600,         # 8eme   : 48 h
    7  * 24 * 3600,    # 9eme+  : 1 semaine
]

async def _analyse_with_mistral(content: str) -> dict:
    """Envoie le message a Mistral Moderation et renvoie les scores 0-1 par categorie."""
    async with aiohttp.ClientSession() as session:
        async with session.post(
            MISTRAL_URL,
            headers={"Authorization": f"Bearer {MISTRAL_API_KEY}"},
            json={"model": MISTRAL_MODEL, "input": content},
            timeout=5,
        ) as res:
            data = await res.json()
            return data["results"][0]["category_scores"]

# CSP strict : on autorise jsdelivr (Bootstrap) et cdn.discordapp.com
# (avatars + icones de serveur). Pas d'inline JS sauf 'unsafe-inline' style.
_CSP = (
    "default-src 'self'; "
    "script-src 'self' https://cdn.jsdelivr.net 'unsafe-inline'; "
    "style-src 'self' https://cdn.jsdelivr.net 'unsafe-inline'; "
    "img-src 'self' https://cdn.discordapp.com data:; "
    "frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
)

@web.middleware
async def _security_headers_mw(request, handler):
    response = await handler(request)
    response.headers.setdefault("X-Frame-Options", "DENY")
    response.headers.setdefault("X-Content-Type-Options", "nosniff")
    response.headers.setdefault("Strict-Transport-Security", "max-age=63072000; includeSubDomains")
    response.headers.setdefault("Content-Security-Policy", _CSP)
    response.headers.setdefault("Referrer-Policy", "same-origin")
    response.headers.setdefault("Permissions-Policy", "geolocation=(), microphone=(), camera=()")
    return response

# Cookie de session : Secure (HTTPS only) + SameSite=Lax (mitigation CSRF
# basique : cookie pas envoye sur cross-site sauf navigation directe).
session_setup(app, NaClCookieStorage(
    nacl_key, cookie_name="yuasbot_dashboard",
    secure=True, samesite="Lax", max_age=7 * 24 * 3600,
))

# Quand un user rejoint le "creator channel", on lui cree un salon vocal
# perso avec lui en owner, puis on l'y deplace. Auto-cleanup si vide.
@commands.Cog.listener()
async def on_voice_state_update(self, member, before, after):
    if member.bot:
        return
    cfg = await get_config(member.guild.id)
    if cfg is None:
        return

    # 1) Creation : user vient de rejoindre le creator channel
    if after.channel is not None and after.channel.id == cfg["creator_channel_id"]:
        category = member.guild.get_channel(cfg["category_id"])
        ch = await member.guild.create_voice_channel(
            name=f"Salon de {member.display_name}"[:100],
            category=category,
            user_limit=cfg.get("default_user_limit", 0),
            overwrites={
                member: discord.PermissionOverwrite(
                    manage_channels=True,
                    move_members=True,
                    connect=True,
                ),
            },
            reason=f"tempvoice create for {member.id}",
        )
        await register_active(ch.id, member.guild.id, member.id)
        await member.move_to(ch, reason="tempvoice move to own channel")

    # 2) Cleanup : un user quitte un temp -> on supprime si vide
    if before.channel is not None and before.channel.id != cfg["creator_channel_id"]:
        active = await get_active(before.channel.id)
        if active is not None and len(before.channel.members) == 0:
            await before.channel.delete(reason="tempvoice empty cleanup")
            await delete_active(before.channel.id)