/**
 * CSRF Token Generation Endpoint
 *
 * Generates and sets CSRF token in cookie for client-side usage
 * Called by frontend before submitting forms to obtain CSRF protection
 */

import { NextResponse } from "next/server";
import { generateCSRFToken, setCSRFCookie } from "@/lib/csrf";

export const dynamic = "force-dynamic";
export const runtime = "nodejs";

/**
 * GET /api/csrf
 *
 * Generates a new CSRF token and sets it in a cookie
 * Also returns the token in the response body for frontend usage
 *
 * @returns JSON response with CSRF token set in cookie and body
 */
export async function GET() {
  const token = generateCSRFToken();
  const response = NextResponse.json(
    {
      success: true,
      csrfToken: token,
    },
    { status: 200 },
  );
  setCSRFCookie(response, token);
  return response;
}
