export const SHOP_ORIGIN_COOKIE_NAME = 'shoptable_shop_origin';
export const SHOPIFY_APP_API_KEY_COOKIE_NAME = 'shoptable_api_key';
export const JWT_COOKIE_NAME = 'shoptable_jwt';

export const baseCookieConfig = {
  secure: true,

  /**
     * We can do strict since we're not doing an embedded app at the moment.
     */
  sameSite: 'strict',
  path: '/',
  domain: 'shoptable.app'
} as const;

export const JSAccessibleCookieConfig = {
  ...baseCookieConfig,

  /**
     * False so that the React app can access them.
     *
     * A cookie with the HttpOnly attribute is inaccessible to the JavaScript Document.cookie API;
     * it is sent only to the server. For example, cookies that persist server-side sessions don't
     * need to be available to JavaScript, and should have the HttpOnly attribute.
     * This precaution helps mitigate cross-site scripting (XSS) attacks.
     *
     * Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
     */
  httpOnly: false,
} as const;

export const AuthCookieConfig = {
  ...baseCookieConfig,

  /**
     * The JWT needs to be stored inside an httpOnly cookie, a special kind of cookie that’s only sent in HTTP requests to the server,
     * and it’s never accessible (both for reading or writing) from JavaScript running in the browser.
     */
  httpOnly: true,
} as const;