<?php
/**
 * Debug CSRF - sofort löschen!
 * Aufruf: debug_csrf.php?token=valu_debug_2026
 */
if (($_GET['token'] ?? '') !== 'valu_debug_2026') die('Kein Zugriff.');
require_once __DIR__ . '/db.php';

echo "<pre>";
echo "SESSION ID: " . session_id() . "\n";
echo "SESSION Inhalt:\n";
foreach ($_SESSION as $k => $v) {
    if ($k !== 'password') echo "  $k = " . (is_array($v) ? json_encode($v) : $v) . "\n";
}
echo "\nCSRF_TOKEN_NAME = " . CSRF_TOKEN_NAME . "\n";
echo "Token in Session: " . ($_SESSION[CSRF_TOKEN_NAME] ?? 'FEHLT') . "\n";
echo "Token generiert: " . Security::generateCSRFToken() . "\n";

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    echo "\nPOST Token: " . ($_POST['csrf_token'] ?? 'FEHLT') . "\n";
    echo "Validierung: " . (Security::validateCSRFToken($_POST['csrf_token'] ?? '') ? 'OK' : 'FEHLER') . "\n";
}
echo "</pre>";

if ($_SERVER['REQUEST_METHOD'] !== 'POST'):
?>
<form method="POST">
    <input type="hidden" name="csrf_token" value="<?php echo Security::generateCSRFToken(); ?>">
    <button type="submit">CSRF Test</button>
</form>
<?php endif; ?>
