<?php
// config/config.php

$envBool = static function(string $key, bool $default): bool {
  $val = getenv($key);
  if ($val === false) {
    return $default;
  }
  $bool = filter_var($val, FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE);
  return $bool ?? $default;
};

$envInt = static function(string $key, int $default): int {
  $val = getenv($key);
  if ($val === false || $val === '') {
    return $default;
  }
  return (int)$val;
};

return [
  'db' => [
    'dsn' => (getenv('DB_DSN') ?: ('mysql:host=' . (getenv('DB_HOST') ?: '127.0.0.1') . ';port=' . (getenv('DB_PORT') ?: '3306') . ';dbname=' . (getenv('DB_NAME') ?: 'scmedia') . ';charset=utf8mb4')),
    'user' => (getenv('DB_USER') ?: 'scmedia'),
    'pass' => (getenv('DB_PASS') ?: 'changeme'),
  ],

  'app' => [
    // Generate once and keep immutable for this instance
    'app_id' => (getenv('APP_ID') ?: 'CHANGE_ME_UUID'),
    'env' => (getenv('APP_ENV') ?: 'development'), // development|production
    'backend_version' => (getenv('BACKEND_VERSION') ?: (getenv('APP_VERSION') ?: '0.1.0')),
    'db_version' => (getenv('DB_VERSION') ?: '0.1.0'),
    'plugins_version' => (getenv('PLUGINS_VERSION') ?: '0.1.0'),

    // Debug tools UI visibility
    'debug_tools_enabled' => $envBool('DEBUG', false),
    'debug_logs_enabled' => $envBool('DEBUG', false),
    'debug_keys_enabled' => $envBool('DEBUG_KEYS', false),

    // Dangerous: allows /api/debug/reset-db
    'allow_db_reset' => $envBool('ALLOW_DB_RESET', true),

    'worker_sleep_seconds' => $envInt('WORKER_SLEEP_SECONDS', 2),
  ],

  'paths' => [
    'incoming' => (getenv('PATH_INCOMING') ?: '/data/incoming'),
    'movies' => (getenv('PATH_MOVIES') ?: '/data/movies'),
    'series' => (getenv('PATH_SERIES') ?: '/data/series'),
  ],

  'video_ext' => array_values(array_filter(array_map('trim', explode(',', (getenv('VIDEO_EXT') ?: 'mkv,mp4,avi,mov,m4v,ts,m2ts,wmv'))))),

  'scanner' => [
    'max_depth' => $envInt('SCANNER_MAX_DEPTH', 3),
    'max_files_per_item' => $envInt('SCANNER_MAX_FILES_PER_ITEM', 3000),
  ],

  'auth' => [
    'jwt_secret' => (getenv('JWT_SECRET') ?: 'CHANGE_ME_JWT_SECRET'),
    'access_ttl_seconds' => $envInt('ACCESS_TTL_SECONDS', 900),
    'refresh_ttl_web_days' => $envInt('REFRESH_TTL_WEB_DAYS', 14),
    'refresh_ttl_mobile_days' => $envInt('REFRESH_TTL_MOBILE_DAYS', 30),
    'challenge_ttl_seconds' => $envInt('AUTH_CHALLENGE_TTL_SECONDS', 300),
    'password_reset_ttl_minutes' => $envInt('PASSWORD_RESET_TTL_MINUTES', 30),
    'max_devices' => $envInt('AUTH_MAX_DEVICES', 5),
    'return_reset_token' => $envBool('AUTH_RETURN_RESET_TOKEN', false),
    'rate_limit_login_max' => $envInt('AUTH_LOGIN_MAX', 10),
    'rate_limit_login_window' => $envInt('AUTH_LOGIN_WINDOW_SECONDS', 900),
    'rate_limit_login_block' => $envInt('AUTH_LOGIN_BLOCK_SECONDS', 900),
    'rate_limit_mfa_max' => $envInt('AUTH_MFA_MAX', 6),
    'rate_limit_mfa_window' => $envInt('AUTH_MFA_WINDOW_SECONDS', 900),
    'rate_limit_mfa_block' => $envInt('AUTH_MFA_BLOCK_SECONDS', 900),
    'sse_key_ttl_seconds' => $envInt('AUTH_SSE_KEY_TTL_SECONDS', 90),
  ],

  // Hard safety rails (GUI cannot exceed)
  'safety' => [
    'hard_limits' => [
      'max_depth' => 10,
      'max_files_per_item' => 200000,
      'max_items_per_scan' => 1000000,
    ],
  ],
];
