<?php

declare(strict_types=1);

return [

    /*
    |--------------------------------------------------------------------------
    | Pireon OAuth2 identity server
    |--------------------------------------------------------------------------
    |
    | This application is an OAuth2 *client* of the Pireon identity server
    | (Laravel Passport). The server owns identity only: it tells us who the
    | user is. Authorisation (roles and permissions) is resolved locally by
    | spatie/laravel-permission — see config/permission.php.
    |
    */

    'server' => rtrim((string) env('PIREON_SERVER', 'https://oauth.pireon.dev'), '/'),

    /*
    | Base path of the server's REST API, as declared in its OpenAPI document
    | ("servers": [{"url": "/api"}]).
    */
    'api_prefix' => '/api',

    'client_id' => env('PIREON_CLIENT_ID'),
    'client_secret' => env('PIREON_CLIENT_SECRET'),

    /*
    | Where the identity server sends the user back after they authorise us.
    | Must match one of the redirect URIs registered for the client.
    */
    'redirect_uri' => env('PIREON_REDIRECT_URI', env('APP_URL', 'http://localhost').'/auth/callback'),

    /*
    | Scopes requested for panel sessions. We only ever need to read the
    | identity of the person logging in, so we stay minimal by default.
    | Add "users:read"/"users:write" if you surface remote user management.
    */
    'scopes' => array_values(array_filter(
        explode(',', (string) env('PIREON_SCOPES', 'account:read'))
    )),

    'endpoints' => [
        'authorize' => '/oauth/authorize',
        'token' => '/oauth/token',
        'user' => '/user',
    ],

    /*
    |--------------------------------------------------------------------------
    | Grants
    |--------------------------------------------------------------------------
    |
    | "authorization_code" (with PKCE) is the interactive flow used by the
    | Filament panel. "password" is kept available for automated tests and
    | first-party mobile clients that cannot open a browser; disable it in
    | production if you do not need it.
    |
    */

    'password_grant_enabled' => (bool) env('PIREON_PASSWORD_GRANT', true),

    /*
    |--------------------------------------------------------------------------
    | Token introspection cache
    |--------------------------------------------------------------------------
    |
    | The identity server exposes no introspection or JWKS endpoint, so an API
    | bearer token is validated by calling GET /api/user upstream with it. That
    | result is cached (keyed by a hash of the token, never the token itself)
    | to keep per-request latency down. Keep this short: it bounds how long a
    | token revoked upstream still works here.
    |
    */

    'introspection_ttl' => (int) env('PIREON_INTROSPECTION_TTL', 60),

    'http_timeout' => (int) env('PIREON_HTTP_TIMEOUT', 10),

    /*
    |--------------------------------------------------------------------------
    | Provisioning
    |--------------------------------------------------------------------------
    |
    | Role granted to a user the first time they sign in. Because authorisation
    | is local-only, a brand new identity gets the least-privileged role and an
    | administrator promotes them from the panel.
    |
    */

    'default_role' => env('PIREON_DEFAULT_ROLE', 'viewer'),

    /*
    | Refuse the session when the identity server reports the account as
    | inactive or still awaiting approval (approved_at === null).
    */
    'require_active_account' => (bool) env('PIREON_REQUIRE_ACTIVE', true),
    'require_approved_account' => (bool) env('PIREON_REQUIRE_APPROVED', true),
];