<?php
declare(strict_types=1);

/**
 * /public_html/test_erp/api/auth/csrf_token.php
 * Session-bound CSRF token endpoint — TEST environment
 */

require_once __DIR__ . '/../../config/session.php';

header('Content-Type: application/json; charset=UTF-8');
header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
header('Pragma: no-cache');

$token = csrf_token();
header('X-CSRF-Token: ' . $token);

echo json_encode([
    'status'  => 200,
    'success' => true,
    'message' => 'CSRF token',
    'data'    => ['csrf_token' => $token],
], JSON_UNESCAPED_UNICODE);
