<?php

class Session {
    public static function init(): void {
        if (session_status() === PHP_SESSION_NONE) {
            session_name(SESSION_NAME);

            // Fix cookie path for subdirectory hosting (e.g. /u69319090039/Shop39/)
            // Without this, CSRF tokens break on POST requests on shared hosting
            $cookiePath = '/';
            if (defined('APP_URL')) {
                $parsed = parse_url(APP_URL);
                $cookiePath = rtrim($parsed['path'] ?? '/', '/') . '/';
                if (empty($cookiePath) || $cookiePath === '/') {
                    $cookiePath = '/';
                }
            }

            session_set_cookie_params([
                'lifetime' => SESSION_LIFETIME,
                'path'     => $cookiePath,
                'secure'   => isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on',
                'httponly' => true,
                'samesite' => 'Lax'
            ]);

            session_start();
        }

        // Generate CSRF token if not exists
        if (empty($_SESSION['csrf_token'])) {
            $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
        }
    }

    public static function set(string $key, $value): void {
        self::init();
        $_SESSION[$key] = $value;
    }

    public static function get(string $key, $default = null) {
        self::init();
        return $_SESSION[$key] ?? $default;
    }

    public static function has(string $key): bool {
        self::init();
        return isset($_SESSION[$key]);
    }

    public static function remove(string $key): void {
        self::init();
        if (isset($_SESSION[$key])) {
            unset($_SESSION[$key]);
        }
    }

    public static function destroy(): void {
        self::init();
        session_unset();
        session_destroy();
    }

    public static function getCsrfToken(): string {
        self::init();
        return $_SESSION['csrf_token'];
    }

    public static function validateCsrfToken(?string $token): bool {
        self::init();
        return !empty($token) && hash_equals($_SESSION['csrf_token'], $token);
    }

    public static function setFlash(string $type, string $message): void {
        self::init();
        $_SESSION['flash'][$type] = $message;
    }

    public static function getFlash(string $type): ?string {
        self::init();
        if (isset($_SESSION['flash'][$type])) {
            $msg = $_SESSION['flash'][$type];
            unset($_SESSION['flash'][$type]);
            return $msg;
        }
        return null;
    }
}