"""
mizan URL Configuration

HTTP endpoints:
- GET  /session/           - Initialize session and get CSRF token (for SSR)
- POST /call/              - Server function calls (HTTP transport)
- GET  /ctx/<name>/        - Bundled context fetch (all functions in a named context)

Security:
- Schema export is NOT exposed over HTTP to prevent API enumeration
- Use the management command instead: python manage.py export_mizan_ir
"""

from django.http import JsonResponse
from django.middleware.csrf import get_token
from django.urls import path
from django.views.decorators.csrf import ensure_csrf_cookie

from .client.executor import function_call_view, context_fetch_view

app_name = "mizan"


@ensure_csrf_cookie
def session_init_view(request):
    """
    Initialize a Django session and return the CSRF token.

    Used by SSR to establish a session before making authenticated requests.
    The @ensure_csrf_cookie decorator ensures the csrftoken cookie is set.

    Returns:
        { "csrfToken": "..." }
    """
    return JsonResponse({"csrfToken": get_token(request)})


urlpatterns = [
    path("session/", session_init_view, name="session-init"),
    path("call/", function_call_view, name="function-call"),
    path("ctx/<str:context_name>/", context_fetch_view, name="context-fetch"),
]
