<?php

declare(strict_types=1);

return [
    'session' => [
        'name' => (string) iav_env('SESSION_COOKIE', 'iav_session'),
        'domain' => (string) iav_env('SESSION_DOMAIN', '.instantaivirtuals.com'),
        'secure' => (bool) iav_env('SESSION_SECURE', true),
        'http_only' => true,
        'same_site' => (string) iav_env('SESSION_SAMESITE', 'Lax'),
        'lifetime_minutes' => (int) iav_env('SESSION_LIFETIME_MINUTES', 120),
        'regenerate_on_login' => true,
    ],
    'csrf' => [
        'enabled' => true,
        'token_bytes' => 32,
        'field_name' => '_token',
        'rotate_after_authentication' => true,
    ],
    'cookies' => [
        'prefix' => '__Host-',
        'secure' => true,
        'http_only' => true,
        'same_site' => 'Lax',
    ],
    'uploads' => [
        'max_bytes' => 8 * 1024 * 1024,
        'allowed_mime_types' => ['image/jpeg', 'image/png', 'image/webp'],
        'randomize_filenames' => true,
        'store_outside_public_root' => true,
        'verify_decoded_image' => true,
    ],
    'headers' => [
        'x_content_type_options' => 'nosniff',
        'x_frame_options' => 'SAMEORIGIN',
        'referrer_policy' => 'strict-origin-when-cross-origin',
        'permissions_policy' => 'camera=(), microphone=(), geolocation=(), payment=()',
    ],
];
