"""CSRF middleware — Origin header validation for POST/PATCH/DELETE."""

from __future__ import annotations

from fastapi import Request, status
from starlette.middleware.base import BaseHTTPMiddleware
from starlette.responses import JSONResponse

from app.config import get_settings


class CSRFMiddleware(BaseHTTPMiddleware):
    """Validate Origin header on all state-changing requests.
    SameSite=Strict cookie + Origin validation = CSRF protection.
    """

    UNSAFE_METHODS = {"POST", "PATCH", "PUT", "DELETE"}

    async def dispatch(self, request: Request, call_next):
        if request.method in self.UNSAFE_METHODS:
            origin = request.headers.get("origin")
            if not origin:
                return JSONResponse(
                    status_code=status.HTTP_403_FORBIDDEN,
                    content={"detail": "Missing Origin header", "code": "csrf_missing_origin"},
                )

            settings = get_settings()
            allowed = settings.cors_origin_list
            # In production, same-origin is enforced; in dev, explicit origins
            if origin not in allowed:
                return JSONResponse(
                    status_code=status.HTTP_403_FORBIDDEN,
                    content={"detail": "Invalid Origin", "code": "csrf_invalid_origin"},
                )

        return await call_next(request)