fix: bootstrap admin CSRF tokens

src/lib/foundation/security-csrf.test.ts

@@ -0,0 +1,41 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+	cookies: vi.fn(),
+	headers: vi.fn(),
+}));
+
+vi.mock("next/headers", () => ({
+	cookies: mocks.cookies,
+	headers: mocks.headers,
+}));
+
+import { readCsrfCookieToken } from "./security";
+
+describe("readCsrfCookieToken", () => {
+	beforeEach(() => {
+		mocks.cookies.mockReset();
+	});
+
+	it("reads an existing valid CSRF cookie without attempting a write", async () => {
+		const token = "a".repeat(64);
+		const set = vi.fn();
+		mocks.cookies.mockResolvedValue({
+			get: (name: string) =>
+				name === "__Host-csrf-token" ? { value: token } : undefined,
+			set,
+		});
+
+		await expect(readCsrfCookieToken()).resolves.toBe(token);
+		expect(set).not.toHaveBeenCalled();
+	});
+
+	it("returns an empty token when no valid cookie exists", async () => {
+		mocks.cookies.mockResolvedValue({
+			get: () => undefined,
+			set: vi.fn(),
+		});
+
+		await expect(readCsrfCookieToken()).resolves.toBe("");
+	});
+});

src/lib/foundation/security.ts

@@ -139,6 +139,16 @@ function trySetCsrfCookie(
 	}
 }
 
+/** Read-only access for Server Components, which cannot write response cookies. */
+export async function readCsrfCookieToken(): Promise<string> {
+	try {
+		return readExistingCsrfCookie(await cookies()) ?? "";
+	} catch {
+		logger.warn("Failed to read CSRF cookie");
+		return "";
+	}
+}
+
 /** Sets the CSRF cookie when possible; returns token or empty string (never throws). */
 export async function setCsrfCookie(): Promise<string> {
 	try {