neiam /diogramos

defmodule DiogramosWeb.Endpoint do
  use Phoenix.Endpoint, otp_app: :diogramos
  use Sentry.PlugCapture

  # The session will be stored in the cookie and signed,
  # this means its contents can be read but not tampered with.
  # Set :encryption_salt if you would also like to encrypt it.
  # Bump the `key` (or `signing_salt`) to silently invalidate every
  # cookie minted by an earlier deploy — useful after rotating
  # secret_key_base or moving from dev → prod.
  @session_options [
    store: :cookie,
    key: "_diogramos_key_v2",
    signing_salt: "dapkIR0G",
    same_site: "Lax"
  ]

  # :uri and :x_headers are what DiogramosWeb.PublicUrl needs to work out
  # the origin a paired device should dial back to.
  socket "/live", Phoenix.LiveView.Socket,
    websocket: [connect_info: [:uri, :x_headers, session: @session_options]],
    longpoll: [connect_info: [:uri, :x_headers, session: @session_options]]

  # Embeds, framed on third-party pages. Browsers don't send the Lax session
  # cookie into a cross-site iframe, and without it /live refuses the join,
  # so the embed would never leave its static render. Embeds are public by
  # token and read no session, so this socket doesn't load one: anything
  # joined over it sees a logged-out visitor.
  socket "/live-embed", Phoenix.LiveView.Socket,
    websocket: true,
    longpoll: true

  # Native clients. Authenticates with an "api" bearer token in the query
  # string rather than the browser session, so it deliberately does not
  # share the LiveView socket's connect_info.
  socket "/socket", DiogramosWeb.UserSocket,
    websocket: [connect_info: [:peer_data, :x_headers]],
    longpoll: false

  # Serve at "/" the static files from "priv/static" directory.
  #
  # When code reloading is disabled (e.g., in production),
  # the `gzip` option is enabled to serve compressed
  # static files generated by running `phx.digest`.
  plug Plug.Static,
    at: "/",
    from: :diogramos,
    gzip: not code_reloading?,
    only: DiogramosWeb.static_paths(),
    raise_on_missing_only: code_reloading?

  # Code reloading can be explicitly enabled under the
  # :code_reloader configuration of your endpoint.
  if code_reloading? do
    socket "/phoenix/live_reload/socket", Phoenix.LiveReloader.Socket
    plug Phoenix.LiveReloader
    plug Phoenix.CodeReloader
    plug Phoenix.Ecto.CheckRepoStatus, otp_app: :diogramos
  end

  plug Phoenix.LiveDashboard.RequestLogger,
    param_key: "request_logger",
    cookie_key: "request_logger"

  plug Plug.RequestId
  plug Plug.Telemetry, event_prefix: [:phoenix, :endpoint]

  plug Plug.Parsers,
    parsers: [:urlencoded, :multipart, :json],
    pass: ["*/*"],
    json_decoder: Phoenix.json_library()

  plug Sentry.PlugContext

  plug Plug.MethodOverride
  plug Plug.Head
  plug Plug.Session, @session_options
  plug DiogramosWeb.Router
end