"""Session bootstrap: the one endpoint reachable without a session (US07-02).

It sets the ``HttpOnly``/``SameSite=Strict`` session cookie and returns the CSRF
token in the body. A foreign page can call this — it just cannot read the answer,
because the app sends no CORS headers — and the cookie it received is never attached
to a request that foreign page initiates.
"""

from __future__ import annotations

from fastapi import APIRouter, Request
from fastapi.responses import JSONResponse

from photo_pipeline.api.security import SESSION_COOKIE

router = APIRouter(tags=["session"])


@router.get("/session")
def start_session(request: Request) -> JSONResponse:
    session = request.app.state.session
    response = JSONResponse({"csrf_token": session.csrf_token})
    response.set_cookie(
        SESSION_COOKIE,
        session.id,
        httponly=True,
        samesite="strict",
        path="/",
    )
    return response