<?php
declare(strict_types=1);

namespace Celena\Core\Template\Tags;

use Celena\Core\Security\Csrf;
use Celena\Core\Template\TagInterface;

/**
 * {csrf}                       → скрытое поле <input type="hidden" name="_csrf" ...>
 * {csrf format="token"}        → только сам токен
 * {csrf format="meta"}         → <meta name="csrf-token" content="..."> (для celena.js)
 */
final class CsrfTag implements TagInterface
{
    public function render(array $params, array $vars, ?string $body = null): string
    {
        $token = Csrf::token();
        $format = (string) ($params['format'] ?? 'field');
        return match ($format) {
            'token' => e($token),
            'meta'  => '<meta name="csrf-token" content="' . e($token) . '">',
            default => '<input type="hidden" name="_csrf" value="' . e($token) . '">',
        };
    }
}
