import secrets

from fastapi import HTTPException, Request, status


CSRF_COOKIE_NAME = "csrf_token"
CSRF_FORM_FIELD = "csrf_token"


def generate_csrf_token() -> str:
    return secrets.token_urlsafe(32)


def ensure_csrf_cookie(request: Request) -> str:
    """Liefert das CSRF-Token für die aktuelle Anfrage (Cookie oder request.state)."""
    state_token = getattr(request.state, "csrf_token", None)
    if state_token:
        return state_token
    cookie_token = request.cookies.get(CSRF_COOKIE_NAME)
    if cookie_token:
        return cookie_token
    return generate_csrf_token()


def validate_csrf(request: Request, form_token: str) -> None:
    cookie_token = request.cookies.get(CSRF_COOKIE_NAME)
    if not cookie_token or not form_token or not secrets.compare_digest(cookie_token, form_token):
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="CSRF-Validierung fehlgeschlagen.")