import { Request, Response } from "express";
import { sendErrorResponse, sendSuccessResponse } from "../../utills/response";
import { generateAndStoreToken, getTokenExpiryMs } from "../../utils/csrfTokenManager";

/**
 * Generate and return a CSRF token for the authenticated user
 *
 * This endpoint must be called after login to obtain a valid CSRF token.
 * The token should be included in the X-CSRF-Token header for all
 * state-changing requests (POST, PUT, DELETE).
 *
 * @route GET /api/csrf-token
 * @access Private (requires authentication)
 */
export const getCsrfToken = async (req: Request, res: Response) => {
    try {
        // User must be authenticated
        const user = (req as any).user;

        if (!user?.id) {
            return sendErrorResponse(res, 401, "Authentication required to obtain CSRF token");
        }

        // Generate and store a new CSRF token for this user
        const token = generateAndStoreToken(user.id.toString());

        // Calculate expiry time
        const expiresIn = getTokenExpiryMs();
        const expiresAt = new Date(Date.now() + expiresIn);

        return sendSuccessResponse(res, 200, "CSRF token generated successfully", {
            csrfToken: token,
            expiresAt: expiresAt.toISOString(),
            expiresInMs: expiresIn,
        });
    } catch (err) {
        console.error("CSRF token generation error:", err);
        return sendErrorResponse(res, 500, "Error generating CSRF token");
    }
};