const COOKIE_NAME = 'token';
const isProd = process.env.NODE_ENV === 'production';

// httpOnly-Cookie statt Token in JS-lesbarem localStorage — verhindert dass ein XSS-Treffer
// das Session-Token einfach per document.cookie/localStorage ausliest.
function setAuthCookie(res, token, maxAgeMs = 8 * 60 * 60 * 1000) {
    res.cookie(COOKIE_NAME, token, {
        httpOnly: true,
        secure: isProd,
        sameSite: 'lax',
        maxAge: maxAgeMs,
        path: '/',
    });
}

function clearAuthCookie(res) {
    res.clearCookie(COOKIE_NAME, { httpOnly: true, secure: isProd, sameSite: 'lax', path: '/' });
}

module.exports = { setAuthCookie, clearAuthCookie, COOKIE_NAME };