/* SPDX-License-Identifier: GPL-3.0-only */
#pragma once
#include "esp_http_server.h"
#include "web_session_store.h"

esp_err_t web_cookie_auth_start(void);
void web_cookie_auth_stop(void);
typedef struct {
    uint32_t login_attempts, login_failures, throttled, capacity_rejections;
    uint32_t security_rejections, logouts, active_challenges;
    bool ready;
} web_cookie_auth_snapshot_t;
void web_cookie_auth_get_snapshot(web_cookie_auth_snapshot_t *snapshot);
void web_cookie_auth_clear_counters(void);
/* Sends an error on denial, with allowed=false. View is caller-wiped. */
esp_err_t web_cookie_auth_require(httpd_req_t *request, bool mutation,
                                  bool upgrade, web_session_view_t *view,
                                  bool *allowed);
esp_err_t web_cookie_auth_handler(httpd_req_t *request);
/* Same mutation policy, allowing a bounded body; caller validates JSON/content type. */
esp_err_t web_cookie_auth_require_json(httpd_req_t *request, size_t body_limit,
                                      web_session_view_t *view, bool *allowed);