(function ($, document) {
    'use strict';

    function getCsrfToken() {
        var meta = document.querySelector('meta[property="glpi:csrf_token"]');
        return meta ? meta.getAttribute('content') : '';
    }

    // GLPI 11 validates the CSRF token of every AJAX POST through the
    // X-Glpi-Csrf-Token header (see CheckCsrfListener). Register the token
    // on all plugin AJAX requests so endpoints such as server_test.ajax.php
    // are accepted instead of being rejected with a 403.
    $(document).on('ajaxSend', function (event, xhr, settings) {
        var token = getCsrfToken();
        if (token !== '' && typeof settings !== 'undefined' && settings.type && settings.type.toUpperCase() === 'POST') {
            xhr.setRequestHeader('X-Glpi-Csrf-Token', token);
        }
    });

    // Also cover direct $.ajax/{$.get[Script]/-free POST}
    var origAjax = $.ajax;
    $.ajax = function (url, options) {
        var settings = $.isPlainObject(url) ? url : $.extend({ url: url }, options || {});
        var token = getCsrfToken();
        if (settings.type && settings.type.toUpperCase() === 'POST' && token !== '') {
            settings.headers = settings.headers || {};
            settings.headers['X-Glpi-Csrf-Token'] = token;
        }
        return origAjax.call(this, settings);
    };
})(jQuery, document);