import type { NextFunction, Request, Response } from 'express';

export function ensureCsrf(req: Request, res: Response, next: NextFunction): void {
  if (!req.session) return next();
  if (!req.session.csrfToken) {
    req.session.csrfToken = Math.random().toString(36).slice(2) + Date.now().toString(36);
  }
  req.csrfToken = () => req.session.csrfToken;
  next();
}

export function requireCsrf(req: Request, res: Response, next: NextFunction): void {
  if (['GET', 'HEAD', 'OPTIONS'].includes(req.method)) return next();
  const token = req.headers['x-csrf-token'];
  if (!token || token !== req.session?.csrfToken) {
    res.status(403).json({ error: 'invalid csrf token' });
    return;
  }
  next();
}