<?php
// app/csrf.php

function csrf_token(): string {
    if (empty($_SESSION['csrf'])) {
        $_SESSION['csrf'] = bin2hex(random_bytes(32));
    }
    return $_SESSION['csrf'];
}

function csrf_verify(string $tokenFromPost): bool {
    return isset($_SESSION['csrf']) && hash_equals($_SESSION['csrf'], $tokenFromPost ?? '');
}
