import crypto from "node:crypto";
import type { Request, Response, NextFunction } from "express";

const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS", "TRACE"]);

export function getCsrfToken(req: Request): string {
  if (!req.session.csrfToken) {
    req.session.csrfToken = crypto.randomBytes(24).toString("hex");
  }
  return req.session.csrfToken;
}

export function csrfProtection(req: Request, res: Response, next: NextFunction): void {
  if (SAFE_METHODS.has(req.method.toUpperCase())) {
    next();
    return;
  }
  const provided = req.headers["x-csrf-token"];
  const token = getCsrfToken(req);
  if (typeof provided === "string" && provided && provided === token) {
    next();
    return;
  }
  res.status(403).json({ error: "CSRF token missing or invalid" });
}