// Desktop-only in-memory CSRF token stash.
//
// tauri-plugin-http's fetch() runs through Rust's reqwest, which keeps its OWN
// cookie jar separate from the webview — document.cookie on tauri://localhost
// never sees the parking_csrf cookie the server sets (open upstream bug,
// tauri-apps/tauri#13045). The cookie IS still sent to the server by reqwest;
// only the client-side READ is broken. So the server echoes the same value in
// the login / me response body (sessionView's csrfToken, routes/auth.ts) and
// the desktop client keeps it here, echoing THIS in X-CSRF-Token instead of
// reading document.cookie.
//
// One module, no imports, so BOTH echo sites can share it without a cycle:
// api.ts (sets it, uses it for apiFetch mutations) and logger.ts (uses it for
// the /api/logs flush — which api.ts imports, so it can't import api.ts back).
// Never persisted: a fresh launch re-learns it via login or /api/auth/me.

let token: string | null = null;

export function setDesktopCsrfToken(value: string | null): void {
  token = value;
}

export function getDesktopCsrfToken(): string | null {
  return token;
}