# see https://symfony.com/doc/current/reference/configuration/framework.html
framework:
    secret: '%env(APP_SECRET)%'
    #csrf_protection: true
    http_method_override: false
    handle_all_throwables: true

    # The OAuth2 redirect_uri handed to MyE&P is generated from the incoming request, so an
    # unvalidated Host header would let a crafted request point the authorization code
    # somewhere else. Regex patterns, matched against the host without the scheme or port.
    trusted_hosts: ['%env(APP_TRUSTED_HOSTS)%']

    # Enables session support. Note that the session will ONLY be started if you read or write from it.
    # Remove or comment this section to explicitly disable session support.
    session:
        handler_id: session.handler.native_file
        cookie_secure: true
        cookie_samesite: lax
        storage_factory_id: session.storage.factory.native
        save_path: '%kernel.project_dir%/var/sessions/%kernel.environment%'
        name: epsession

    #esi: true
    #fragments: true
    php_errors:
        log: true

    router:
        default_uri: '%env(APP_BASE_URI)%'

    # Every call to the sibling MyE&P application, both the token request and the API
    # itself. Paths are given relative to the base uri, so without a leading slash.
    http_client:
        scoped_clients:
            myep.client:
                base_uri: '%env(MYEP_API_BASE_URL)%'
                timeout: 10
                max_duration: 30
                headers:
                    Accept: application/json
                retry_failed:
                    max_retries: 2
                    # 401 is deliberately absent: it needs the cached token dropped
                    # before the retry, which App\MyEp\Api\ApiClient does itself.
                    http_codes: [423, 425, 429, 500, 502, 503, 504]

when@test:
    framework:
        test: true
        session:
            storage_factory_id: session.storage.factory.mock_file