// The single browser-facing cookie. It holds only an opaque session id,
// never a Minnect token (ADR-001). httpOnly keeps it out of JavaScript.

export const SESSION_COOKIE = "mfb_session";

export interface SessionCookieOptions {
  httpOnly: true;
  secure: boolean;
  sameSite: "lax";
  path: "/";
}

export function sessionCookieOptions(): SessionCookieOptions {
  return {
    httpOnly: true,
    // Secure is required in production (ADR-001). It is relaxed in local
    // development so the cookie works over plain http on localhost.
    secure: process.env.NODE_ENV !== "development",
    sameSite: "lax",
    path: "/",
  };
}