<?php
declare(strict_types=1);
namespace App\Auth;

use App\Http\{Request, Response};

final class CsrfController
{
    public function token(Request $req, SessionStore $sess): Response
    {
        if ($sess->get('user_id') === null) {
            return Response::json(['error' => 'unauthorized'], 401);
        }
        if ($sess->get('csrf') === null) {
            $sess->set('csrf', bin2hex(random_bytes(32)));
        }
        return Response::json(['token' => $sess->get('csrf')]);
    }
}