import "server-only";
import { NextResponse } from "next/server";

/**
 * CSRF guard for JSON route handlers. Server Actions already compare Origin with Host in Next.js;
 * route handlers that change state call this too. Cookies are SameSite=Lax as a second layer.
 */
export function sameOrigin(req: Request): boolean {
  if (req.method === "GET" || req.method === "HEAD") return true;
  const origin = req.headers.get("origin");
  const host = req.headers.get("x-forwarded-host") ?? req.headers.get("host");
  if (!origin || !host) return false;
  try {
    return new URL(origin).host === host;
  } catch {
    return false;
  }
}

export function forbidden(msg = "Cross-site request blocked.") {
  return NextResponse.json({ error: msg }, { status: 403 });
}