<?php

declare(strict_types=1);

namespace App\Core;

use App\Core\Http\Request;
use App\Core\Http\Response;

abstract class Controller
{
    protected function render(string $view, array $data = [], ?string $layout = 'layouts/main'): string
    {
        return View::render($view, $data, $layout);
    }

    protected function json(mixed $data, int $statusCode = 200): Response
    {
        $response = new Response();
        return $response->json($data, $statusCode);
    }

    protected function redirect(string $url, ?string $flashSuccess = null, ?string $flashError = null): Response
    {
        if ($flashSuccess) {
            View::setFlash('success', $flashSuccess);
        }
        if ($flashError) {
            View::setFlash('error', $flashError);
        }

        $response = new Response();
        return $response->redirect($url);
    }

    protected function validateCsrf(Request $request): bool
    {
        if (session_status() === PHP_SESSION_NONE) {
            session_start();
        }

        $token = $request->post('_csrf') ?: $request->getHeader('X-CSRF-Token');
        $sessionToken = $_SESSION['csrf_token'] ?? null;

        return $token && $sessionToken && hash_equals($sessionToken, $token);
    }
}