<?php
/**
 * Application Configuration
 *
 * @package Licenzo
 */

// Prevent direct access
if (!defined('ABSPATH')) {
    exit;
}

return [

    /*
    |--------------------------------------------------------------------------
    | Application Name
    |--------------------------------------------------------------------------
    */
    'name'               => 'Licenzo',

    /*
    |--------------------------------------------------------------------------
    | Application Version
    |--------------------------------------------------------------------------
    */
    'version'            => LICENZO_VERSION,

    /*
    |--------------------------------------------------------------------------
    | Application Environment
    |--------------------------------------------------------------------------
    */
    'env'                => defined('WP_DEBUG') && WP_DEBUG ? 'development' : 'production',

    /*
    |--------------------------------------------------------------------------
    | Application Mode (dev/prod)
    |--------------------------------------------------------------------------
    */
    'mode' => 'prod',

    /*
    |--------------------------------------------------------------------------
    | Debug Mode
    |--------------------------------------------------------------------------
    */
    'debug'              => defined('WP_DEBUG') && WP_DEBUG,

    /*
    |--------------------------------------------------------------------------
    | Vite Configuration
    |--------------------------------------------------------------------------
    */
    'vite'               => [
        'dev_server'    => 'http://localhost:3000',
        'manifest_path' => 'assets/.vite/manifest.json',
        'assets_path'   => 'assets/',
        'development'   => defined('WP_DEBUG') && WP_DEBUG,
    ],

    /*
    |--------------------------------------------------------------------------
    | Global Middleware
    |--------------------------------------------------------------------------
    |
    | Middleware that runs on ALL routes. Add middleware aliases here.
    | Example: 'monitor', 'cors'
    |
    */
    'global_middlewares' => [
        // Add middleware aliases that should run on every route
        // Leave empty for now, users can add as needed
    ],

    /*
    |--------------------------------------------------------------------------
    | Route Middleware (Aliases)
    |--------------------------------------------------------------------------
    |
    | Middleware available as aliases for routes.
    | Use these aliases in route definitions.
    |
    */
    'middlewares'        => [
        'auth'          => \Licenzo\Http\Middleware\Authenticate::class,
        'customer_auth' => \Licenzo\Http\Middleware\CustomerAuthenticate::class,
        'throttle'      => \Licenzo\Http\Middleware\RateLimit::class,
    ],

    'plugin' => [
        'file'     => LICENZO_PLUGIN_FILE,
        'dir'      => LICENZO_PLUGIN_DIR,
        'url'      => LICENZO_PLUGIN_URL,
        'basename' => LICENZO_PLUGIN_BASENAME,
        'version'  => LICENZO_VERSION,
        'name'     => 'Licenzo',
        'slug'     => 'licenzo',
        'prefix'   => 'licenzo',
        'domain'   => 'licenzo',
    ],

    /*
    |--------------------------------------------------------------------------
    | Trusted Proxies (Client-IP Trust Boundary)
    |--------------------------------------------------------------------------
    |
    | List of IPs / CIDR ranges that are trusted to set the
    | `trusted_proxy_header` (default: X-Forwarded-For).
    |
    | Default is EMPTY, which is the safe posture for most deployments:
    | only the one-hop REMOTE_ADDR is trusted as the client identity. Any
    | X-Forwarded-For value is ignored unless REMOTE_ADDR is in this list.
    |
    | Opt in ONLY when your site is actually fronted by a trusted proxy
    | (load balancer, reverse proxy, CDN). Misconfiguring this makes IP-
    | based rate limiting and audit logging attacker-spoofable.
    |
    | Supported entry formats:
    |   - exact IPv4:   '10.0.0.1'
    |   - exact IPv6:   '2001:db8::1'
    |   - IPv4 CIDR:    '10.0.0.0/8'
    |   - IPv6 CIDR:    '2001:db8::/32'
    |
    | Example for a site behind an nginx load balancer on a private net:
    |   'trusted_proxies' => ['10.0.0.0/8'],
    |
    */
    'trusted_proxies'       => [],
    'trusted_proxy_header'  => 'HTTP_X_FORWARDED_FOR',

    /*
    |--------------------------------------------------------------------------
    | Rate Limit Policies
    |--------------------------------------------------------------------------
    |
    | Named rate-limit policies referenced from routes via
    | `throttle:<policy>` (e.g. `throttle:activation`). Unknown policy
    | names silently fall back to `default` with a one-time warning.
    |
    | Bucket identity is route-aware: routes with `{license}` bucket per
    | license key, routes with `{token}` bucket per token, and
    | `/webhooks/<provider>` routes bucket per gateway. Authenticated
    | requests bucket per WP user. Anonymous requests with no relational
    | identifier (e.g. v2 header-based activation routes) fall back to
    | per-IP bucketing, which preserves v1.0.0 behavior on those paths.
    |
    | NOTE: No 'admin' policy is defined this release. Admin routes remain
    | unthrottled intentionally — we have no measured baseline for admin
    | bulk operations (imports, product admin, etc.). Re-evaluate once
    | production usage patterns are observed.
    |
    */
    'rate_limits' => [
        'default'     => ['requests' => 60,   'window' => 3600],
        // 30 requests / 10 min per license. Sized for legitimate operator
        // patterns (post-purchase activation, multi-site rollout, key
        // rotation) under per-license bucketing — IP-based bucketing is
        // a fallback for header-auth routes that have no {license} param.
        'activation'  => ['requests' => 30,   'window' => 600],
        'public_read' => ['requests' => 60,   'window' => 3600],  // per license / token
        'webhook'     => ['requests' => 600,  'window' => 60],    // per gateway provider
    ],

    /*
    |--------------------------------------------------------------------------
    | Rate Limit — Global per-IP safety net
    |--------------------------------------------------------------------------
    |
    | Applied ON TOP OF the per-policy bucket for any policy listed in
    | `rate_limit_public_policies`. Prevents volumetric abuse across many
    | distinct route templates from the same source IP.
    |
    */
    'rate_limit_global_per_ip' => ['requests' => 1000, 'window' => 3600],

    /*
    |--------------------------------------------------------------------------
    | Rate Limit — Public Policies
    |--------------------------------------------------------------------------
    |
    | Policies in this list are treated as public-facing and subject to
    | the global per-IP safety net above. Non-public policies (currently
    | only `default`) are subject to their per-policy bucket only.
    |
    */
    'rate_limit_public_policies' => ['activation', 'public_read', 'webhook'],

];
