defmodule BullXWeb.Endpoint do
  @moduledoc """
  Phoenix endpoint for the BullX web shell.

  The endpoint installs the custom sealed session store before routing so setup,
  console, and login flows all share the same tamper-resistant cookie boundary.
  """

  use Phoenix.Endpoint, otp_app: :bullx

  # The session is stored in a cookie sealed by BullX.Ext AEAD. The browser
  # carries the payload, but cannot read or tamper with its contents.
  @session_options [
    store: BullXWeb.SessionCookieStore,
    key: "_bullx_key",
    key_context: "_bullx_key",
    http_only: true,
    secure: Application.compile_env(:bullx, :session_cookie_secure, false),
    same_site: "Lax"
  ]

  # Serve at "/" the static files from "priv/static" directory.
  #
  # When code reloading is disabled (e.g., in production),
  # the `gzip` option is enabled to serve compressed
  # static files generated by running `phx.digest`.
  plug Plug.Static,
    at: "/",
    from: :bullx,
    gzip: not code_reloading?,
    only: BullXWeb.static_paths(),
    raise_on_missing_only: code_reloading?

  # Code reloading can be explicitly enabled under the
  # :code_reloader configuration of your endpoint.
  if code_reloading? do
    plug Phoenix.CodeReloader
    plug Phoenix.Ecto.CheckRepoStatus, otp_app: :bullx
  end

  plug Plug.RequestId
  plug Plug.Telemetry, event_prefix: [:phoenix, :endpoint]

  plug Plug.Parsers,
    parsers: [:urlencoded, :multipart, :json],
    pass: ["*/*"],
    json_decoder: Phoenix.json_library()

  plug Plug.MethodOverride
  plug Plug.Head
  plug Plug.Session, @session_options
  plug BullXWeb.Router
end
