<?php

use function apexl\io\env;

return [
    'requires_auth' => filter_var(env('APP_REQUIRES_AUTH', false), FILTER_VALIDATE_BOOLEAN),

    'jwt' => [
        'secret_key' => env('AUTH_JWT_SECRET_KEY'),
        'lifetime' => env('AUTH_JWT_LIFETIME', 1200),
        'algorithm' => env('AUTH_JWT_ALGORITHM', 'HS256'),
    ],

    'refresh' => [
        'algorithm' => env('AUTH_REFRESH_ALGORITHM', 'sha256'),
        // Default refresh-token lifetime (seconds). Consumers may override via
        // env; e.g. Canal Nav runs 604800 (7 days). Kept at 24h here so existing
        // consumers' behaviour is unchanged.
        'lifetime' => env('AUTH_REFRESH_LIFETIME', 86400),
        // Lifetime (seconds) for a "Stay signed in" / remember-me login, stored
        // per-row in refresh_tokens.lifetime. Default 60 days.
        'lifetime_remember' => env('AUTH_REFRESH_LIFETIME_REMEMBER', 5184000),
        // Refresh-token ROTATION. Default OFF: the refresh call extends the
        // existing token in place and the response is access_token only, exactly
        // as before. When ON, each refresh mints a new refresh_token (returned in
        // the response) and expires the old one after a short grace window — only
        // enable for clients that persist the returned refresh_token.
        'rotate' => filter_var(env('AUTH_REFRESH_ROTATE', false), FILTER_VALIDATE_BOOLEAN),
        'salt' => env('AUTH_REFRESH_SALT', ''),
    ],

    'users_can_register' => filter_var(env('AUTH_USERS_CAN_REGISTER', false), FILTER_VALIDATE_BOOLEAN),

    'reset_password_lifetime' => env('AUTH_RESET_PASSWORD_LIFETIME', 86400),
    'client_id' => env('AUTH_CLIENT_ID'),
    'client_secret' => env('AUTH_CLIENT_ID'),
    'sessionTimeout' => env('AUTH_SESSION_TIMEOUT', 2629746),
    'enableGodUser' => filter_var(env('AUTH_ENABLE_GOD_USER', true), FILTER_VALIDATE_BOOLEAN),
    'disable_route_permissions_locally' => filter_var(
        env('AUTH_DISABLE_ROUTE_PERMISSIONS_LOCALLY', false),
        FILTER_VALIDATE_BOOLEAN
    ),
    'enable_query_string_login' => filter_var(env('AUTH_ENABLE_QUERY_STRING_LOGIN', false), FILTER_VALIDATE_BOOLEAN),
    'send_new_user_notification' => filter_var(env('AUTH_SEND_NEW_USER_NOTIFICATION', false), FILTER_VALIDATE_BOOLEAN),
    'login_messages' => [
        'logged_out' => env('AUTH_LOGIN_MESSAGES_LOGGED_OUT', 'You have been logged out'),
    ]
];
