package web

import (
	"net/http"

	"tug/internal/transport/web/text"
)

func (k *Kit) endedSessionForm(again http.HandlerFunc) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		r.Body = http.MaxBytesReader(w, r.Body, maxFormBytes)
		if _, live := PrincipalFrom(r); live || r.PostFormValue(csrfField) == "" {
			k.renderError(w, r, http.StatusForbidden, text.ErrorForbiddenTitle, text.ErrorFormExpired)
			return
		}
		again(w, r)
	})
}