const express = require('express');
const cookieParser = require('cookie-parser');
const session = require('express-session');
const csrf = require('csurf');
const bodyParser = require('body-parser');

const app = express();
const port = 3000;

// Middleware setup
app.use(cookieParser());
app.use(bodyParser.urlencoded({ extended: false })); // For parsing application/x-www-form-urlencoded

// Session middleware (required for csurf)
app.use(session({
  secret: 'your-secret-key-for-session',
  resave: false,
  saveUninitialized: true,
  cookie: { secure: process.env.NODE_ENV === 'production', httpOnly: true, sameSite: 'lax' }
}));

// CSRF middleware. Requires cookie-parser and session middleware.
// `value` can be a function that returns the token from a request, e.g., req.body._csrf, req.query._csrf, or a custom header.
const csrfProtection = csrf({ cookie: true });

// Example routes
app.get('/', csrfProtection, (req, res) => {
  const csrfToken = req.csrfToken();
  res.send(`
    <h1>CSRF Protected Form</h1>
    <form action="/process" method="POST">
      <input type="hidden" name="_csrf" value="${csrfToken}">
      <label for="message">Message:</label>
      <input type="text" id="message" name="message">
      <button type="submit">Submit</button>
    </form>
    <p>CSRF Token: <code>${csrfToken}</code></p>
  `);
});

app.post('/process', csrfProtection, (req, res) => {
  // If CSRF token is valid, process the request
  console.log('Received message:', req.body.message);
  res.send('Form submitted successfully! Message: ' + req.body.message);
});

// Error handling for CSRF issues
app.use((err, req, res, next) => {
  if (err.code === 'EBADCSRFTOKEN') {
    res.status(403).send('Invalid CSRF token. Request blocked.');
  } else {
    next(err);
  }
});

app.listen(port, () => {
  console.log(`Server listening at http://localhost:${port}`);
});