<?php
declare(strict_types=1);

function csrf_token(): string
{
    if (empty($_SESSION['csrf_token'])) {
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    }
    return $_SESSION['csrf_token'];
}

function verify_csrf(): void
{
    if ($_SERVER['REQUEST_METHOD'] === 'GET') {
        return;
    }

    $token =
        $_SERVER['HTTP_X_CSRF_TOKEN']
        ?? $_POST['csrf_token']
        ?? null;

    if (!$token || !hash_equals($_SESSION['csrf_token'] ?? '', $token)) {
        /*json_response([
            'error' => 'Invalid CSRF token'
        ], 403);*/
        error_forbidden('Invalid CSRF token');
    }
}
