/**
 * CSRF Controller
 *
 * Provides CSRF token generation endpoint for client applications.
 */

import { Controller, Get, Res } from "@nestjs/common";
import { Response } from "express";
import * as crypto from "crypto";
import { SkipCsrf } from "../decorators/skip-csrf.decorator";

@Controller("api/v1/csrf")
export class CsrfController {
  /**
   * Generate and set CSRF token
   * Returns token to client and sets it in httpOnly cookie
   */
  @Get("token")
  @SkipCsrf() // This endpoint itself doesn't need CSRF protection
  getCsrfToken(@Res({ passthrough: true }) response: Response): { token: string } {
    // Generate cryptographically secure random token
    const token = crypto.randomBytes(32).toString("hex");

    // Set token in httpOnly cookie
    response.cookie("csrf-token", token, {
      httpOnly: true,
      secure: process.env.NODE_ENV === "production",
      sameSite: "strict",
      maxAge: 24 * 60 * 60 * 1000, // 24 hours
    });

    // Return token to client (so it can include in X-CSRF-Token header)
    return { token };
  }
}