<?php
declare(strict_types=1);

require_once __DIR__ . '/../../config/constants.php';
require_once __DIR__ . '/../../core/Response.php';
require_once __DIR__ . '/../../security/auth_guard_api.php';

/**
 * CSRF Token Endpoint
 * GET /api/security/csrf
 */

session_name(SESSION_NAME);
session_start();

if (empty($_SESSION['employee_id'])) {
    Response::error('Unauthorized', 401);
}

if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

Response::success('CSRF token issued', [
    'csrf_token' => $_SESSION['csrf_token']
]);
