<?php

return [

    /*
    |--------------------------------------------------------------------------
    | Control-Plane / Licensing (Phase 0 — multi-site platform)
    |--------------------------------------------------------------------------
    |
    | SYHC operates a central "control plane" (its own Dataverse environment)
    | holding one license row per site deployment. Each row carries the site's
    | license state AND an encrypted bundle of that site's secrets. A site
    | phones home to validate its license and pull its secrets, caching the
    | result locally so it survives brief control-plane downtime.
    |
    | DORMANT BY DEFAULT: the entire layer is a no-op unless a site opts in by
    | setting SITE_LICENSE_KEY + the CONTROL_PLANE_* bootstrap creds. When
    | disabled the app reads every secret from .env exactly as the original
    | single-deployment build did — fully backwards-compatible.
    |
    */

    // Master switch — enabled only when a site is provisioned with a license
    // key AND bootstrap creds. Baked at config:cache time; safe for production
    // (stays false on any deployment that hasn't set these env vars).
    'enabled' => ! empty(env('SITE_LICENSE_KEY')) && ! empty(env('CONTROL_PLANE_CLIENT_ID')),

    // The license key identifying THIS site's row in the control-plane table.
    'license_key' => env('SITE_LICENSE_KEY'),

    /*
    | Bootstrap client-credentials for the SYHC control-plane Dataverse env.
    | In Azure AD / Dataverse this app user is scoped to READ ONLY the license
    | table — never a business env. This is the ONLY Dataverse credential that
    | remains in a site's .env; all business-env creds are fetched from the
    | control plane and never written to disk in plaintext.
    */
    'tenant_id'       => env('CONTROL_PLANE_TENANT_ID'),
    'client_id'       => env('CONTROL_PLANE_CLIENT_ID'),
    'client_secret'   => env('CONTROL_PLANE_CLIENT_SECRET'),
    'environment_url' => rtrim((string) env('CONTROL_PLANE_ENV_URL', ''), '/'),
    'api_version'     => env('CONTROL_PLANE_API_VERSION', 'v9.2'),

    // Entity-set (plural) of the license/secret table in the control-plane env.
    'table' => env('CONTROL_PLANE_TABLE', 'cr6f2_sitelicenses'),

    // Logical column names on that table (override per env if the prefix differs).
    'fields' => [
        'license_key'   => env('CONTROL_PLANE_FIELD_KEY', 'cr6f2_licensekey'),
        'status'        => env('CONTROL_PLANE_FIELD_STATUS', 'cr6f2_status'),        // active | suspended | expired
        'plan'          => env('CONTROL_PLANE_FIELD_PLAN', 'cr6f2_plan'),
        'expiry'        => env('CONTROL_PLANE_FIELD_EXPIRY', 'cr6f2_expirydate'),
        'features'      => env('CONTROL_PLANE_FIELD_FEATURES', 'cr6f2_features'),    // JSON or comma list
        'site_name'     => env('CONTROL_PLANE_FIELD_SITENAME', 'cr6f2_sitename'),
        'secret_bundle' => env('CONTROL_PLANE_FIELD_BUNDLE', 'cr6f2_secretbundle'),  // encrypted (see license:seal)
    ],

    /*
    | Symmetric key used to decrypt the secret bundle stored in the table.
    | Format: "base64:<key>" (same shape as APP_KEY). Held by the site; without
    | it the fetched ciphertext is useless. SYHC seals bundles with the SAME key
    | (license:seal). Keep OUT of source control.
    */
    'decrypt_key' => env('SECRET_DECRYPT_KEY'),
    'cipher'      => env('SECRET_BUNDLE_CIPHER', 'AES-256-CBC'),

    /*
    | Local caching — stale-while-revalidate so the site keeps running when the
    | control plane is briefly unreachable.
    |   hard_ttl_minutes  : how long a last-known-good bundle is retained/served.
    |   refresh_every_min : proactive re-pull cadence (also run via license:refresh cron).
    |   negative_ttl_sec  : after a fetch failure, cool-down before the next per-request
    |                       retry, so a control-plane outage can't cause an HTTP storm.
    */
    'cache_key'         => 'controlplane.bundle',
    'hard_ttl_minutes'  => (int) env('CONTROL_PLANE_HARD_TTL', 10080), // 7 days
    'refresh_every_min' => (int) env('CONTROL_PLANE_REFRESH_EVERY', 15),
    'negative_ttl_sec'  => (int) env('CONTROL_PLANE_NEGATIVE_TTL', 60),

    // Short HTTP timeout (seconds) so a slow control plane can't hang requests.
    'timeout' => (int) env('CONTROL_PLANE_TIMEOUT', 10),

    // Bootstrap OAuth token cache.
    'token_cache_key' => 'controlplane_access_token',
    'token_ttl'       => (int) env('CONTROL_PLANE_TOKEN_TTL', 50), // minutes

    /*
    |--------------------------------------------------------------------------
    | Credit plane (dormant — see CONTROL_PLANE.md "Credit plane")
    |--------------------------------------------------------------------------
    |
    | Deliberately NOT a direct Dataverse connection. A client-administered
    | site Dataverse env (or a compromised site server) must never hold a
    | credential capable of increasing/setting a balance — so credit balance
    | + rates live behind a small SYHC-operated proxy instead, reached only
    | over this narrow, deduct/read-only HTTP contract. Top-up and rate
    | changes are NEVER exposed here or to any site; they only exist in
    | SYHC's own PO-only tooling, on a credential no site ever holds.
    |
    | Independent of 'enabled' above — a site can be licensed without the
    | credit plane being live yet (staged rollout), or vice versa.
    */
    'credit' => [
        'enabled' => ! empty(env('CREDIT_PLANE_URL')) && ! empty(env('CREDIT_PLANE_TOKEN')),
        'url'     => rtrim((string) env('CREDIT_PLANE_URL', ''), '/'),
        // Narrow, deduct+read-only bearer token identifying THIS site to the
        // proxy. Never a token capable of topup/rate-change.
        'token'   => env('CREDIT_PLANE_TOKEN'),
        'timeout' => (int) env('CREDIT_PLANE_TIMEOUT', 10),
    ],

];
