/**
 * Build Set-Cookie header values for access and refresh tokens.
 *
 * Access token cookie: HttpOnly, Secure (default true), SameSite=Strict,
 *   Path=/, Max-Age=3600 (1 hour)
 * Refresh token cookie: HttpOnly, Secure (default true), SameSite=Strict,
 *   Path=/, Max-Age=2592000 (30 days)
 */
export function buildSessionCookies(
  accessToken: string,
  refreshToken: string,
  options?: { secure?: boolean },
): string[] {
  const secure = options?.secure ?? true
  const secureFlag = secure ? '; Secure' : ''

  const accessCookie = `rcs_access=${accessToken}; Path=/; HttpOnly; SameSite=Strict; Max-Age=3600${secureFlag}`

  const refreshCookie = `rcs_refresh=${refreshToken}; Path=/; HttpOnly; SameSite=Strict; Max-Age=2592000${secureFlag}`

  return [accessCookie, refreshCookie]
}

/**
 * Build Set-Cookie headers to clear session cookies.
 */
export function buildClearCookies(): string[] {
  return [
    'rcs_access=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0',
    'rcs_refresh=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0',
  ]
}