<?php

declare(strict_types=1);

/**
 * Core application configuration.
 *
 * Values are pulled from the environment (.env) with sensible defaults so the
 * app runs out of the box in development.
 */

return [
    // Human-readable product name shown in the UI and emails.
    'name' => env('APP_NAME', 'BotGuard'),

    // Base URL used when building absolute links (no trailing slash).
    'url' => env('APP_URL', 'http://localhost:8000'),

    // When true, detailed error messages are shown. NEVER enable in production.
    'debug' => (bool) env('APP_DEBUG', false),

    // Application environment: local | staging | production.
    'env' => env('APP_ENV', 'production'),

    // 32+ char key used for symmetric encryption of sensitive settings.
    'key' => env('APP_KEY', ''),

    'timezone' => env('APP_TIMEZONE', 'UTC'),

    // Session cookie configuration.
    'session_name'     => env('SESSION_NAME', 'BOTGUARD_SESSID'),
    'session_lifetime' => (int) env('SESSION_LIFETIME', 7200),
    'cookie_domain'    => env('COOKIE_DOMAIN', ''),

    // Proxies whose X-Forwarded-For / CF-Connecting-IP headers may be trusted.
    'trusted_proxies' => array_filter(array_map('trim', explode(',', (string) env('TRUSTED_PROXIES', '')))),

    // HTTP-level rate limiting (per client IP).
    'rate_limit' => [
        'per_minute' => (int) env('RATE_LIMIT_PER_MINUTE', 120),
    ],
];
