# Trunk configuration for the CSR/WASM UI.
#
# Run modes (never change the redirect URI off http://127.0.0.1:3000/callback):
#   dev  (E2E target): `cd crates/web && trunk serve --port 3000`
#         plus the BFF on :3001; this file proxies /oauth/, /callback, /api/.
#         Trunk's proxy follows the BFF's /oauth/start 302 to the AS and swallows
#         it (200 empty body), so sign-in MUST bypass the proxy: run the BFF with
#         `APP_START_URL=http://127.0.0.1:3001/oauth/start` and the landing CTA
#         navigates straight at the BFF origin (top-level assign, cookies are
#         host-scoped so SameSite=Lax still holds across :3000 -> :3001).
#   demo/prod: `SERVER_BIND_ADDR=127.0.0.1:3000 cargo run -p server`
#         serves crates/web/dist directly; no Trunk process, no proxies, no
#         APP_START_URL override (relative /oauth/start is same-origin).
#
# Build (verification): `trunk build`. The executor never runs `trunk serve`.

[build]
target = "index.html"

# Strict-CSP boot (no inline scripts). Trunk's default autoloader is an inline
# `<script type="module">`, which the BFF's `STATIC_CSP` (`script-src 'self'
# 'wasm-unsafe-eval'`, no `'unsafe-inline'`) refuses to execute. So:
#   - inject_scripts = false: Trunk injects no inline loader and no preloads;
#   - filehash = false: stable `web-app.js` / `web-app_bg.wasm` names that the
#     external `bootstrap.js` module can import statically (a content hash is
#     unknowable to a static loader).
# `bootstrap.js` is copied to the dist root (see index.html) and referenced
# there as a plain same-origin `<script type="module" src="/bootstrap.js">`.
inject_scripts = false
filehash = false

[serve]
addresses = ["127.0.0.1"]
port = 3000

# Forward every BFF-owned route to the axum server on :3001 so the browser
# sees a single origin (no CORS, cookies stay same-site). With no `rewrite`
# the backend path is the match prefix: /oauth/start -> :3001/oauth/start.
[[proxy]]
backend = "http://127.0.0.1:3001/oauth/"

[[proxy]]
backend = "http://127.0.0.1:3001/callback"

[[proxy]]
backend = "http://127.0.0.1:3001/api/"

# Pin CLI tools so the wasm-bindgen CLI matches the crate dependency exactly
# (`wasm-bindgen = "=0.2.129"` in Cargo.toml) and Tailwind runs v4.
# The Tailwind CLI is a standalone binary; no Node/npm is required.
[tools]
wasm_bindgen = "0.2.129"
tailwindcss = "4.3.3"