from fastapi import Request

from app.core.config import settings


def cookie_secure(request: Request) -> bool:
    """Secure-Flag nur setzen, wenn aktiviert und die Anfrage wirklich per HTTPS läuft."""
    if not settings.cookie_secure:
        return False
    forwarded = request.headers.get("x-forwarded-proto", "")
    if forwarded:
        return forwarded.split(",")[0].strip().lower() == "https"
    return request.url.scheme == "https"