// Cookie construction, centralized so the Secure attribute is set consistently everywhere
// instead of hand-built per call site. Secure is opt-in via COOKIE_SECURE=1 — off by default
// because local dev and the current single-VM pilot deployment run over plain HTTP; anything
// served over real HTTPS should set COOKIE_SECURE=1 (see docs/PHASE3A... "production HTTPS
// expectations").

const SECURE = process.env.COOKIE_SECURE === '1';

function buildCookie(name, value, { maxAgeSec, httpOnly = true } = {}) {
  const parts = [`${name}=${value}`, 'Path=/', 'SameSite=Lax'];
  if (httpOnly) parts.push('HttpOnly');
  if (SECURE) parts.push('Secure');
  parts.push(`Max-Age=${maxAgeSec != null ? maxAgeSec : 0}`);
  return parts.join('; ');
}

function clearCookie(name) {
  return buildCookie(name, '', { maxAgeSec: 0 });
}

module.exports = { buildCookie, clearCookie };