<?php

use function apexl\io\env;

return [
    'requires_auth' => filter_var(env('APP_REQUIRES_AUTH', false), FILTER_VALIDATE_BOOLEAN),

    'jwt' => [
        'secret_key' => env('AUTH_JWT_SECRET_KEY'),
        'lifetime' => env('AUTH_JWT_LIFETIME', 1200),
        'algorithm' => env('AUTH_JWT_ALGORITHM', 'HS256'),
    ],

    'refresh' => [
        'algorithm' => env('AUTH_REFRESH_ALGORITHM', 'sha256'),
        // Default refresh-token lifetime (seconds). Consumers may override via
        // env; e.g. Canal Nav runs 604800 (7 days). Kept at 24h here so existing
        // consumers' behaviour is unchanged.
        'lifetime' => env('AUTH_REFRESH_LIFETIME', 86400),
        // Lifetime (seconds) for a "Stay signed in" / remember-me login, stored
        // per-row in refresh_tokens.lifetime. Default 60 days.
        'lifetime_remember' => env('AUTH_REFRESH_LIFETIME_REMEMBER', 5184000),
        // Refresh-token ROTATION. Default OFF: the refresh call extends the
        // existing token in place and the response is access_token only, exactly
        // as before. When ON, each refresh mints a new refresh_token (returned in
        // the response) and expires the old one after a short grace window — only
        // enable for clients that persist the returned refresh_token.
        'rotate' => filter_var(env('AUTH_REFRESH_ROTATE', false), FILTER_VALIDATE_BOOLEAN),
        'salt' => env('AUTH_REFRESH_SALT', ''),
    ],

    // Two-factor authentication (TOTP). DEFAULT OFF: with 'mode' unset/off there
    // is ZERO behavioural change for any existing consumer — the login gate and
    // the enforcement middleware both short-circuit immediately. See Plan 007.
    'two_factor' => [
        // off | optional | enforced
        'mode' => env('AUTH_TWO_FACTOR_MODE', 'off'),
        // Issuer shown in the authenticator app / QR provisioning URI.
        'app_name' => env('AUTH_TWO_FACTOR_APP_NAME', env('APP_NAME', 'Cygnus')),
        // Enforced-mode grace window (days) for as-yet-unenrolled users. 0 =
        // immediate (unenrolled users are blocked on the next request).
        'grace_period_days' => (int) env('AUTH_TWO_FACTOR_GRACE_PERIOD_DAYS', 0),
        // TOTP verification tolerance in periods (±N * 30s) for clock drift.
        'verify_discrepancy' => (int) env('AUTH_TWO_FACTOR_VERIFY_DISCREPANCY', 1),
        // Brute-force lockout: N failed attempts within the window locks the
        // method for `lockout_minutes`. Carried forward from V1 (10 / 15 min).
        'lockout_max_attempts' => (int) env('AUTH_TWO_FACTOR_LOCKOUT_MAX_ATTEMPTS', 10),
        'lockout_minutes' => (int) env('AUTH_TWO_FACTOR_LOCKOUT_MINUTES', 15),
        // Number of one-time recovery codes generated at enrolment.
        'recovery_code_count' => (int) env('AUTH_TWO_FACTOR_RECOVERY_CODE_COUNT', 8),
        // Secret-at-rest encryption key (apexl/hashing Encrypt, AES-256-CBC).
        // Falls back to the JWT secret so no new required env var is introduced;
        // set a dedicated key to rotate 2FA secrets independently of the JWT.
        'encryption_key' => env('AUTH_TWO_FACTOR_ENCRYPTION_KEY', env('AUTH_JWT_SECRET_KEY')),
    ],

    'users_can_register' => filter_var(env('AUTH_USERS_CAN_REGISTER', false), FILTER_VALIDATE_BOOLEAN),

    'reset_password_lifetime' => env('AUTH_RESET_PASSWORD_LIFETIME', 86400),
    'client_id' => env('AUTH_CLIENT_ID'),
    'client_secret' => env('AUTH_CLIENT_ID'),
    'sessionTimeout' => env('AUTH_SESSION_TIMEOUT', 2629746),
    'enableGodUser' => filter_var(env('AUTH_ENABLE_GOD_USER', true), FILTER_VALIDATE_BOOLEAN),
    'disable_route_permissions_locally' => filter_var(
        env('AUTH_DISABLE_ROUTE_PERMISSIONS_LOCALLY', false),
        FILTER_VALIDATE_BOOLEAN
    ),
    'enable_query_string_login' => filter_var(env('AUTH_ENABLE_QUERY_STRING_LOGIN', false), FILTER_VALIDATE_BOOLEAN),
    'send_new_user_notification' => filter_var(env('AUTH_SEND_NEW_USER_NOTIFICATION', false), FILTER_VALIDATE_BOOLEAN),
    'login_messages' => [
        'logged_out' => env('AUTH_LOGIN_MESSAGES_LOGGED_OUT', 'You have been logged out'),
    ],

    // Where PermissionMiddleware sends a SIGNED-IN user denied a display route.
    // DEFAULT UNSET (null): zero behavioural change — denied display routes keep
    // answering with the login redirect and route detection is untouched. Set to
    // a path ('/access-denied') or a registered route name ('shell.access-denied')
    // to send authenticated-but-denied users to a real access-denied page;
    // anonymous callers still go to login. Only set it if that route exists.
    'access_denied' => [
        'redirect' => env('AUTH_ACCESS_DENIED_REDIRECT'),
    ],
];
