import { Module } from '@nestjs/common';
import { Logger } from 'nestjs-pino';
import { createCsrfMiddleware } from './csrf.middleware';
import { CSRF_MIDDLEWARE, type RequestHandler } from './security.token';

/**
 * Phase-2 security primitives (per the `main.ts` placeholder note
 * left in earlier PRs). For now: the CSRF middleware. Helmet and
 * the CORS allowlist parser are wired directly in `main.ts` because
 * they are pure stateless configuration — they don't need DI.
 *
 * Future phase-2 work that will fit here: rate limiting, structured
 * error filter, request-size limits.
 */
@Module({
  providers: [
    {
      provide: CSRF_MIDDLEWARE,
      inject: [Logger],
      useFactory: (logger: Logger): RequestHandler => createCsrfMiddleware(logger),
    },
  ],
  exports: [CSRF_MIDDLEWARE],
})
export class SecurityModule {}
