<?php
namespace App\Middleware;

class Security
{
    // Generate CSRF token jika belum ada
    public static function generateCSRF()
    {
        if (session_status() === PHP_SESSION_NONE) session_start();

        if (!isset($_SESSION['csrf_token'])) {
            $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
        }
        return $_SESSION['csrf_token'];
    }

    // Cek token CSRF
    public static function csrfCheck()
    {
        if ($_SERVER['REQUEST_METHOD'] === 'POST') {
            if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
                die('CSRF token mismatch!');
            }
        }
    }
}
