/**
 * CSRF Token Endpoint
 *
 * Provides CSRF tokens to clients for protected requests
 * Token is set as cookie and returned in response body
 */

import { NextResponse } from "next/server";
import { generateCSRFToken, setCSRFCookie } from "@/lib/csrf";

export async function GET() {
  const token = generateCSRFToken();
  const response = NextResponse.json({
    csrfToken: token,
  });

  // Set token as cookie for double-submit pattern
  setCSRFCookie(response, token);

  return response;
}

// Allow CSRF endpoint without CSRF validation (it generates the token)
export const dynamic = "force-dynamic";
