package com.example.web;

import java.nio.charset.StandardCharsets;
import java.security.*;
import java.util.Base64;
import jakarta.servlet.http.HttpSession;

public final class Csrf {
    private static final SecureRandom RANDOM=new SecureRandom();
    private Csrf() {}
    public static String token(HttpSession session) {
        synchronized(session) {
            String token=(String)session.getAttribute("csrfToken");
            if(token==null) {
                byte[] bytes=new byte[32]; RANDOM.nextBytes(bytes);
                token=Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
                session.setAttribute("csrfToken",token);
            }
            return token;
        }
    }
    public static boolean valid(String expected,String submitted) {
        return expected!=null && submitted!=null && MessageDigest.isEqual(
            expected.getBytes(StandardCharsets.UTF_8),submitted.getBytes(StandardCharsets.UTF_8));
    }
}