# see https://symfony.com/doc/current/reference/configuration/framework.html
framework:
    secret: '%env(APP_SECRET)%'

    # The OAuth2 redirect_uri is generated from the incoming request, so the Host and the
    # X-Forwarded-* headers decide where myep is told to send the authorization code. Both lists
    # read the standard SYMFONY_* variables Symfony already defaults to, and are spelled out here
    # because leaving them implicit is what made them easy to overlook. Set SYMFONY_TRUSTED_HOSTS
    # per environment -- an empty value means every Host header is accepted.
    trusted_hosts: '%env(default::SYMFONY_TRUSTED_HOSTS)%'
    # Only ever needed behind a TLS-terminating proxy. Without it the generated redirect_uri of
    # such a deployment comes out as http://, and the flow breaks rather than downgrading quietly.
    trusted_proxies: '%env(default::SYMFONY_TRUSTED_PROXIES)%'
    trusted_headers: ['x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-forwarded-port', 'x-forwarded-prefix']

    # Note that the session will be started ONLY if you read or write from it.
    #
    # Everything here is pinned rather than left to the default, because a session cookie is the
    # whole of this application's authentication once the OAuth2 flow is over. cookie_secure and
    # cookie_samesite happen to match the defaults; save_path does not, and it is the one that
    # matters in production -- deploy.php shares var/sessions between releases, and without this
    # sessions land in PHP's default directory and every release logs everybody out.
    session:
        handler_id: session.handler.native_file
        save_path: '%kernel.project_dir%/var/sessions/%kernel.environment%'
        name: epsession
        cookie_secure: true
        cookie_samesite: lax
        cookie_httponly: true

    form:
        csrf_protection:
            # Symfony defaults this to {data-controller: csrf-protection}, which only made sense
            # while the stateless CSRF Stimulus controller existed. We use plain session-backed
            # tokens, so the hidden field needs no attributes at all.
            field_attr: {}

    #esi: true
    #fragments: true

when@test:
    framework:
        test: true
        session:
            storage_factory_id: session.storage.factory.mock_file