///////////////////////////////////////////////////////////////////////////////
// Initializing session
ini_set('session.gc_maxlifetime', 3600);
ini_set('session.cookie_httponly', 1);
ini_set('session.cookie_secure', 1);

if (!SameSiteNoneBug\unsafe()) {
    if (PHP_MINOR_VERSION >= 3) { //TODO: remove after PHP 7.3
        ini_set('session.cookie_samesite', 'None');
    } else {
        ini_set('session.cookie_path', '/; samesite=None'); //won't work on PHP 7.3
    }
}
if (!stristr($_SERVER['REQUEST_URI'], '/ordermonitor')    //doesn't need session
    && !stristr($_SERVER['REQUEST_URI'], '/tracking')     //doesn't need session
    && !stristr($_SERVER['REQUEST_URI'], '/squareoauth')  //start the session in the controller
    && !stristr($_SERVER['REQUEST_URI'], '/manager')      //start the session when checking authorization
    && !$isWellKnownRequest                               //.well-known is a public, sessionless response
) {
    session_start();
}

///////////////////////////////////////////////////////////////////////////////
// Initializing debugger pieces - session must be initialized first!
// TODO: figure out a way to enable IS_DEBUG through domains in production (i.e. in the customer pages of custom domain restaurants)
define(
    'IS_DEBUG',
    !$isWellKnownRequest //public verification responses must remain byte-exact
    && (DevLevel > 0 || isset($_SESSION['admin_id'])) //is a developer or a SuperAdmin
    && (isset($_REQUEST['debug']) || isset($_COOKIE['debug'])) //enabled debug, now or previously
    && (!isset($_REQUEST['debug']) || $_REQUEST['debug'] != '0') //and is passively using it, and not trying to disable
);

if (!$isWellKnownRequest && isset($_REQUEST['debug']) && $_REQUEST['debug'] == '0') {
    deletecookie('debug', '/');
} elseif (IS_DEBUG) {
    setcookie('debug', '1', time() + (60 * 60), '/');
}

App::initializeDebugbar();

 
// AWS target-group health checks use an IP-based Host header, so respond before the normal hostname,
// session, and database bootstrap. Reaching this point verifies the web server, PHP, and autoloader.
$healthCheckPath = parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH);
if ($healthCheckPath === '/healthz') {
    header('Content-Type: text/plain; charset=utf-8');
    header('Cache-Control: no-store');
    if (($_SERVER['HTTP_X_EHUNGRY_HEALTH_CHECK'] ?? '') !== '1') {
        http_response_code(404);
        echo 'Not Found';
        exit;
    }
    http_response_code(200);
    echo 'OK';
    exit;
}
 
// Global.php is the core setup file for the application
App::debugbarTime('Global.php');
require(dirname(__DIR__) . '/PHP/Global.php');
App::debugbarTime('Global.php');
/** @var string $controller The main controller - defined at /PHP/Global.php */
 
App::debugbarTime('Sentry - controller');
ErrorHandlers::sentryInit($controller); //doesn't always do much - not every controller has a Sentry project
App::debugbarTime('Sentry - controller');
 
App::debugbarTime("controller: $controller");
apache_note('AppController', $controller);
if (file_exists(CORE_PATH."lib/helpers/$controller.php")) {
    require CORE_PATH."lib/helpers/$controller.php";
}
require CORE_PATH."controllers/$controller.php";
App::debugbarTime("controller: $controller");