<?php

declare(strict_types=1);

namespace Framework\Controller;

// @responsibility: CSRF-Token-Handling für Controller

use Framework\CsrfService;

trait CsrfTrait
{
    protected function csrfToken(): string
    {
        return CsrfService::getToken();
    }

    protected function csrfField(): string
    {
        return CsrfService::getTokenField();
    }

    protected function validateCsrf(): bool
    {
        $token = $_POST['_csrf_token'] ?? $_SERVER['HTTP_X_CSRF_TOKEN'] ?? null;

        return CsrfService::validateToken($token);
    }

    protected function requireCsrf(): void
    {
        if (!$this->validateCsrf()) {
            if ($this->isJsonRequest()) {
                $this->json(['error' => 'CSRF token invalid'], 403);
            } else {
                $this->text('CSRF token invalid', 403);
            }
            exit;
        }
    }

    private function isJsonRequest(): bool
    {
        $accept = $_SERVER['HTTP_ACCEPT'] ?? '';
        $contentType = $_SERVER['CONTENT_TYPE'] ?? '';

        return str_contains($accept, 'application/json') || str_contains($contentType, 'application/json');
    }
}