<?php
/**
 * Security Configuration
 * Centralized settings for Rate Limiting, File Uploads, Headers, Session, and Scrubbing
 */

return [
    // Rate Limiting (attempts => window_seconds)
    'rate_limits' => [
        'login'          => ['max' => 5,  'decay' => 900],   // 5 attempts per 15 minutes
        'register'       => ['max' => 5,  'decay' => 3600],  // 5 attempts per hour
        'password_reset' => ['max' => 3,  'decay' => 3600],  // 3 attempts per hour
        'payment_slip'   => ['max' => 10, 'decay' => 600],   // 10 uploads per 10 minutes
        'review_report'  => ['max' => 10, 'decay' => 600],   // 10 reports per 10 minutes
        'api_general'    => ['max' => 60, 'decay' => 60],    // 60 requests per minute
    ],

    // File Upload Security
    'uploads' => [
        'max_size_avatar'       => 2 * 1024 * 1024, // 2MB
        'max_size_store_image'  => 2 * 1024 * 1024, // 2MB
        'max_size_product'      => 5 * 1024 * 1024, // 5MB
        'max_size_review'       => 5 * 1024 * 1024, // 5MB
        'max_size_payment_slip' => 5 * 1024 * 1024, // 5MB

        'allowed_image_mimes' => [
            'image/jpeg' => ['jpg', 'jpeg'],
            'image/png'  => ['png'],
            'image/webp' => ['webp']
        ],

        'magic_bytes' => [
            'image/jpeg' => ["\xFF\xD8\xFF"],
            'image/png'  => ["\x89\x50\x4E\x47\x0D\x0A\x1A\x0A"],
            'image/webp' => ["RIFF"]
        ]
    ],

    // Sensitive parameter scrubber for logs (mask with '******')
    'scrub_keys' => [
        'password',
        'confirm_password',
        'current_password',
        'new_password',
        'confirm_new_password',
        'password_confirmation',
        'token',
        'csrf_token',
        'secret',
        'api_key',
        'bank_account_no',
        'card_number',
        'cvv',
        'pin'
    ],

    // Security Headers
    'headers' => [
        'X-Content-Type-Options' => 'nosniff',
        'X-Frame-Options'        => 'SAMEORIGIN',
        'X-XSS-Protection'       => '1; mode=block',
        'Referrer-Policy'        => 'strict-origin-when-cross-origin',
        'Permissions-Policy'     => 'geolocation=(), camera=(), microphone=()'
    ]
];