Initial commit

2026-09-16 23:20:08 +07:00
commit 0041668dbb
32577 changed files with 3687927 additions and 0 deletions
@@ -0,0 +1,66 @@
+<?php
+/**
+ * Thai Traditional Massage Queue Management System (TTMQMS)
+ * Enterprise Security Configuration (Argon2id, JWT, 2FA TOTP RFC6238, OWASP)
+ *
+ * @package App\Config
+ */
+
+return [
+    // Password Hashing Algorithm (Argon2id - OWASP Recommended)
+    'password_hash' => [
+        'algo' => PASSWORD_ARGON2ID,
+        'options' => [
+            'memory_cost' => 65536, // 64 MB
+            'time_cost' => 4,       // 4 iterations
+            'threads' => 1,         // 1 parallel thread
+        ],
+    ],
+
+    // JSON Web Token (JWT) Authentication
+    'jwt' => [
+        'secret' => getenv('JWT_SECRET') ?: 'ttmqms_super_secret_enterprise_key_2026_owasp_compliance_256bit',
+        'algo' => 'HS256',
+        'access_token_ttl' => 3600,         // 60 นาที (1 ชั่วโมง)
+        'refresh_token_ttl' => 604800,      // 7 วัน
+        'issuer' => 'https://ttmqms.hospital.local',
+        'audience' => 'ttmqms_pwa_client',
+    ],
+
+    // Two-Factor Authentication (Google Authenticator TOTP RFC6238)
+    'two_factor' => [
+        'enabled' => true,
+        'issuer' => 'TTMQMS Enterprise',
+        'time_step' => 30, // 30 วินาทีตามมาตรฐาน TOTP
+        'digits' => 6,
+        'window' => 1, // ยอมรับเวลาก่อนหน้าและหลัง 1 step ป้องกันนาฬิกาคลาดเคลื่อน
+        'remember_device_days' => 30,
+        'recovery_code_count' => 8,
+    ],
+
+    // Rate Limiting & Brute Force Protection
+    'rate_limit' => [
+        'enabled' => true,
+        'max_requests_per_minute' => 60,
+        'login_max_attempts' => 5,
+        'lockout_duration_minutes' => 15,
+    ],
+
+    // Security Headers & Content Security Policy (CSP)
+    'headers' => [
+        'X-Content-Type-Options' => 'nosniff',
+        'X-Frame-Options' => 'DENY',
+        'X-XSS-Protection' => '1; mode=block',
+        'Referrer-Policy' => 'strict-origin-when-cross-origin',
+        'Strict-Transport-Security' => 'max-age=31536000; includeSubDomains; preload',
+        'Content-Security-Policy' => "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https:; connect-src 'self' ws: wss: http: https:;",
+    ],
+
+    // CORS Policy
+    'cors' => [
+        'allowed_origins' => ['*'], // ใน Production ควรระบุ Domain เช่น https://ttmqms.hospital.local
+        'allowed_methods' => ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+        'allowed_headers' => ['Content-Type', 'Authorization', 'X-Requested-With', 'X-CSRF-Token'],
+        'max_age' => 86400,
+    ],
+];