<?php
declare(strict_types=1);

/**
 * Shared session for all Android Cast web consoles (crashes, build, …).
 * Same cookie path + session name => one login across sub-apps.
 */
function platform_is_https_request(): bool
{
    if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
        return true;
    }
    $fwd = strtolower(trim((string) ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '')));
    if ($fwd === 'https') {
        return true;
    }
    $front = strtolower(trim((string) ($_SERVER['HTTP_FRONT_END_HTTPS'] ?? '')));
    if ($front === 'on') {
        return true;
    }
    // Public vhosts are TLS-terminated at the FE; upstream PHP only sees HTTP :80.
    $host = strtolower(preg_replace('/:\d+$/', '', (string) ($_SERVER['HTTP_HOST'] ?? '')));
    return in_array($host, ['apps.f0xx.org', 's.f0xx.org', 'notify.f0xx.org'], true);
}

function platform_start_session(string $sessionName = 'ac_crash_sess', string $cookiePath = '/app/androidcast_project'): void
{
    if (session_status() === PHP_SESSION_ACTIVE) {
        return;
    }
    session_name($sessionName);
    session_set_cookie_params([
        'lifetime' => 0,
        'path' => $cookiePath,
        'httponly' => true,
        'samesite' => 'Lax',
        'secure' => platform_is_https_request(),
    ]);
    session_start();
}