<?php

return [
    'name' => $_ENV['APP_NAME'] ?? 'Kaffeekasse SaaS',
    'env' => $_ENV['APP_ENV'] ?? 'production',
    'debug' => (($_ENV['APP_DEBUG'] ?? '0') === '1'),
    'url' => rtrim($_ENV['APP_URL'] ?? 'http://localhost:8080', '/'),
    'timezone' => $_ENV['APP_TIMEZONE'] ?? 'Europe/Berlin',
    'app_key' => $_ENV['APP_KEY'] ?? '',
    'allow_public_registration' => (($_ENV['ALLOW_PUBLIC_REGISTRATION'] ?? '0') === '1'),
    'rfid_ingest_enabled' => (($_ENV['RFID_INGEST_ENABLED'] ?? '0') === '1'),
    'db' => [
        'host' => $_ENV['DB_HOST'] ?? '127.0.0.1',
        'port' => (int) ($_ENV['DB_PORT'] ?? 3306),
        'name' => $_ENV['DB_NAME'] ?? '',
        'user' => $_ENV['DB_USER'] ?? '',
        'pass' => $_ENV['DB_PASS'] ?? '',
        'charset' => 'utf8mb4',
    ],
    'mail' => [
        'from' => trim($_ENV['MAIL_FROM'] ?? 'noreply@example.com'),
        'reply_to' => trim($_ENV['MAIL_REPLY_TO'] ?? ''),
        'subject_prefix' => $_ENV['MAIL_SUBJECT_PREFIX'] ?? '[Kaffeekasse] ',
        'log_fallback' => (($_ENV['MAIL_LOG_FALLBACK'] ?? '1') === '1'),
        'log_file' => trim($_ENV['MAIL_LOG_FILE'] ?? ''),
    ],
    'password_reset' => [
        'reset_url' => $_ENV['PASSWORD_RESET_URL']
            ?? rtrim($_ENV['APP_URL'] ?? 'http://localhost:8080', '/') . '/reset-password?token={{token}}',
        'ttl_minutes' => max(5, (int) ($_ENV['PASSWORD_RESET_TTL_MINUTES'] ?? 60)),
        'max_active_tokens' => max(1, (int) ($_ENV['PASSWORD_RESET_MAX_ACTIVE_TOKENS'] ?? 3)),
        'subject' => $_ENV['PASSWORD_RESET_SUBJECT'] ?? 'Passwort zuruecksetzen',
    ],
    'rate_limits' => [
        'login' => [
            'max_attempts' => max(1, (int) ($_ENV['RATE_LIMIT_LOGIN_MAX_ATTEMPTS'] ?? 5)),
            'window_seconds' => max(60, (int) ($_ENV['RATE_LIMIT_LOGIN_WINDOW_SECONDS'] ?? 900)),
            'block_seconds' => max(60, (int) ($_ENV['RATE_LIMIT_LOGIN_BLOCK_SECONDS'] ?? 900)),
        ],
        'registration' => [
            'max_attempts' => max(1, (int) ($_ENV['RATE_LIMIT_REGISTRATION_MAX_ATTEMPTS'] ?? 3)),
            'window_seconds' => max(60, (int) ($_ENV['RATE_LIMIT_REGISTRATION_WINDOW_SECONDS'] ?? 3600)),
            'block_seconds' => max(60, (int) ($_ENV['RATE_LIMIT_REGISTRATION_BLOCK_SECONDS'] ?? 3600)),
        ],
    ],
    'rfid_shared_secret' => $_ENV['RFID_SHARED_SECRET'] ?? '',
];