Provides a router macro for mounting the PhoenixFlags dashboard.

Usage

defmodule MyAppWeb.Router do
  use Phoenix.Router
  import PhoenixFlags.Router

  scope "/admin" do
    pipe_through [:browser, :require_admin]

    flags_dashboard "/flags",
      config: MyApp.SystemConfig,
      on_mount: [{MyAppWeb.UserAuth, :require_admin}]
  end

The dashboard does no authorisation of its own. A pipeline guards the page request but not the LiveView's socket: the signed session it hands the browser can be replayed to reconnect, after the admin who opened the page has lost the role. Always pass an :on_mount hook that checks again.

end

Options

• :config (required) — the module that use PhoenixFlags

• :on_mount — list of Phoenix.LiveView.on_mount/1 hooks to add to the live session. This is where authorisation belongs: see above.

• :csp_nonce_assign_key — the conn assign holding your Content Security Policy nonce, e.g. :csp_nonce. Given, the script tag carries it, so a policy with 'strict-dynamic' or no 'self' still loads the bundle.

• :app_js — path to the host application's JS bundle, which must connect a LiveSocket. Defaults to "/assets/js/app.js".

• :favicon — href for the dashboard's icon. Defaults to "data:,", an empty document, which stops the browser asking: a layout with no icon makes it request /favicon.ico, and a host that does not serve one gets a 404 in the console of an otherwise working page. Point it at your own to show it instead.

• :app_js_type — the script tag's type. Pass "module" when the host bundle is ESM, which esbuild emits with --format=esm and which any bundle using import() for code splitting needs. Omitted by default, so a classic bundle is loaded as it always was.

  Getting this wrong is quiet and total: an ESM bundle loaded as a classic script throws import declarations may only appear at top level of a module before it defines anything, so the LiveSocket never connects and every control on the dashboard does nothing at all.