module Api
  class BaseController < ApplicationController
    # the app sends the CSRF token from the page's meta tag as X-CSRF-Token
    protect_from_forgery with: :exception

    rescue_from ActiveRecord::RecordNotFound do
      render json: { error: "not_found" }, status: :not_found
    end
    rescue_from ActiveRecord::RecordInvalid do |e|
      render json: { error: "invalid", messages: e.record.errors.full_messages }, status: :unprocessable_entity
    end
    rescue_from ActionController::InvalidAuthenticityToken do
      render json: { error: "csrf" }, status: :unprocessable_entity
    end

    private

    # a share link token, for visitors (with or without account) who got the link
    def share_token = request.headers["X-Share-Token"].presence

    # identifies the lock holder: one browser tab
    def client_id = request.headers["X-Client-Id"].to_s[0, 64].presence || "anon"

    def lock_holder = "#{Current.user&.id || 'anon'}:#{client_id}"

    def holder_name = Current.user&.name || "Jemand mit dem Link"
  end
end