<?php

namespace App\Core;

final class Csrf
{
    public function __construct(private readonly Session $session)
    {
    }

    public function token(): string
    {
        $token = $this->session->get('_csrf_token');

        if (!is_string($token) || $token === '') {
            $token = bin2hex(random_bytes(32));
            $this->session->put('_csrf_token', $token);
        }

        return $token;
    }

    public function validate(?string $token): bool
    {
        $expected = $this->session->get('_csrf_token');

        return is_string($expected) && is_string($token) && hash_equals($expected, $token);
    }
}