<?php
/**
 * Thai Traditional Massage Queue Management System (TTMQMS)
 * Enterprise Security Configuration (Argon2id, JWT, 2FA TOTP RFC6238, OWASP)
 *
 * @package App\Config
 */

return [
    // Password Hashing Algorithm (Argon2id - OWASP Recommended)
    'password_hash' => [
        'algo' => PASSWORD_ARGON2ID,
        'options' => [
            'memory_cost' => 65536, // 64 MB
            'time_cost' => 4,       // 4 iterations
            'threads' => 1,         // 1 parallel thread
        ],
    ],

    // JSON Web Token (JWT) Authentication
    'jwt' => [
        'secret' => getenv('JWT_SECRET') ?: 'ttmqms_super_secret_enterprise_key_2026_owasp_compliance_256bit',
        'algo' => 'HS256',
        'access_token_ttl' => 3600,         // 60 นาที (1 ชั่วโมง)
        'refresh_token_ttl' => 604800,      // 7 วัน
        'issuer' => 'https://ttmqms.hospital.local',
        'audience' => 'ttmqms_pwa_client',
    ],

    // Two-Factor Authentication (Google Authenticator TOTP RFC6238)
    'two_factor' => [
        'enabled' => true,
        'issuer' => 'TTMQMS Enterprise',
        'time_step' => 30, // 30 วินาทีตามมาตรฐาน TOTP
        'digits' => 6,
        'window' => 1, // ยอมรับเวลาก่อนหน้าและหลัง 1 step ป้องกันนาฬิกาคลาดเคลื่อน
        'remember_device_days' => 30,
        'recovery_code_count' => 8,
    ],

    // Rate Limiting & Brute Force Protection
    'rate_limit' => [
        'enabled' => true,
        'max_requests_per_minute' => 60,
        'login_max_attempts' => 5,
        'lockout_duration_minutes' => 15,
    ],

    // Security Headers & Content Security Policy (CSP)
    'headers' => [
        'X-Content-Type-Options' => 'nosniff',
        'X-Frame-Options' => 'DENY',
        'X-XSS-Protection' => '1; mode=block',
        'Referrer-Policy' => 'strict-origin-when-cross-origin',
        'Strict-Transport-Security' => 'max-age=31536000; includeSubDomains; preload',
        'Content-Security-Policy' => "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https:; connect-src 'self' ws: wss: http: https:;",
    ],

    // CORS Policy
    'cors' => [
        'allowed_origins' => ['*'], // ใน Production ควรระบุ Domain เช่น https://ttmqms.hospital.local
        'allowed_methods' => ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
        'allowed_headers' => ['Content-Type', 'Authorization', 'X-Requested-With', 'X-CSRF-Token'],
        'max_age' => 86400,
    ],
];