package middleware

import (
	"crypto/subtle"
	"net/http"

	"github.com/freefire/jiang13-bbs/service"
	"github.com/gin-gonic/gin"
)

// CSRFMiddleware CSRF 防护中间件
// 对 POST/PUT/DELETE 等状态变更请求，校验 X-CSRF-Token header 与 cookie 中的 CSRF token 是否一致
func CSRFMiddleware() gin.HandlerFunc {
	return func(c *gin.Context) {
		// 仅对状态变更方法校验
		if c.Request.Method == http.MethodGet || c.Request.Method == http.MethodHead || c.Request.Method == http.MethodOptions {
			c.Next()
			return
		}

		cookieToken, err := c.Cookie(service.CSRFCookieName)
		if err != nil || cookieToken == "" {
			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "CSRF token 缺失"})
			return
		}

		headerToken := c.GetHeader(service.CSRFHeaderName)
		// 常量时间比较，避免通过响应耗时逐字节猜测 CSRF token
		if headerToken == "" ||
			subtle.ConstantTimeCompare([]byte(headerToken), []byte(cookieToken)) != 1 {
			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "CSRF 校验失败"})
			return
		}

		c.Next()
	}
}