<?php

declare(strict_types=1);

return [
    'enabled' => true,
    'storage_path' => 'data/registration-requests.json',
    'ldif_export_dir' => 'data/registration-ldif',
    'identity_counter_path' => 'data/registration-identity-counter.json',
    'reset_token_path' => 'data/password-reset-tokens.json',
    'approver_groups' => ['administrators', 'appadmin'],
    'approver_usernames' => [],
    'password_crypto_key' => getenv('REGISTRATION_PASSWORD_KEY') ?: '',
    'reset_link_ttl_hours' => 8,
    'abuse_protection' => [
        'honeypot_field' => 'website',
        'rate_limit_storage_path' => 'data/public-form-rate-limit.json',
        'rules' => [
            'registration' => [
                'max_attempts' => 5,
                'window_seconds' => 900,
            ],
            'password_reset' => [
                'max_attempts' => 5,
                'window_seconds' => 900,
            ],
        ],
        'turnstile' => [
            'enabled' => filter_var(getenv('TURNSTILE_ENABLED') ?: 'false', FILTER_VALIDATE_BOOL),
            'site_key' => getenv('TURNSTILE_SITE_KEY') ?: '',
            'secret_key' => getenv('TURNSTILE_SECRET_KEY') ?: '',
        ],
    ],
    'mail' => [
        'enabled' => true,
        'from_email' => getenv('MAIL_FROM_EMAIL') ?: 'noreply@desktop.kusche.berlin',
        'from_name' => getenv('MAIL_FROM_NAME') ?: 'Kusche.Berlin Desktop',
        'log_path' => 'data/mail.log',
    ],
    'ldap' => [
        'enabled' => true,
        'host' => getenv('LDAP_HOST') ?: '127.0.0.1',
        'port' => (int) (getenv('LDAP_PORT') ?: 389),
        'bind_dn' => getenv('LDAP_BIND_DN') ?: '',
        'bind_password' => getenv('LDAP_BIND_PASSWORD') ?: '',
        'use_starttls' => filter_var(getenv('LDAP_USE_STARTTLS') ?: 'false', FILTER_VALIDATE_BOOL),
        'users_dn' => 'cn=users,dc=nas,dc=kusche,dc=berlin',
        'default_groups' => [
            'cn=generaluser,cn=groups,dc=nas,dc=kusche,dc=berlin',
        ],
        'pending_group_dn' => getenv('LDAP_PENDING_GROUP_DN') ?: 'cn=pending,cn=groups,dc=nas,dc=kusche,dc=berlin',
        'available_groups' => [
            ['dn' => 'cn=administrators,cn=groups,dc=nas,dc=kusche,dc=berlin', 'label' => 'Administrators'],
            ['dn' => 'cn=appadmin,cn=groups,dc=nas,dc=kusche,dc=berlin', 'label' => 'App Admin'],
            ['dn' => 'cn=dockers,cn=groups,dc=nas,dc=kusche,dc=berlin', 'label' => 'Dockers'],
            ['dn' => 'cn=family,cn=groups,dc=nas,dc=kusche,dc=berlin', 'label' => 'Family'],
            ['dn' => 'cn=generaluser,cn=groups,dc=nas,dc=kusche,dc=berlin', 'label' => 'General User'],
            ['dn' => 'cn=internalfamily,cn=groups,dc=nas,dc=kusche,dc=berlin', 'label' => 'Internal Family'],
            ['dn' => 'cn=users,cn=groups,dc=nas,dc=kusche,dc=berlin', 'label' => 'Users'],
        ],
        'group_assignment_mode' => getenv('LDAP_GROUP_ASSIGNMENT_MODE') ?: 'group_memberuid',
        'group_member_attribute' => getenv('LDAP_GROUP_MEMBER_ATTRIBUTE') ?: 'memberUid',
        'default_login_shell' => '/bin/sh',
        'home_directory_prefix' => '/home',
        'uid_number_start' => (int) (getenv('LDAP_UID_NUMBER_START') ?: 1000010),
        'gid_number_default' => (int) (getenv('LDAP_GID_NUMBER_DEFAULT') ?: 1000012),
        'samba_domain_sid' => getenv('LDAP_SAMBA_DOMAIN_SID') ?: 'S-1-5-21-2039032496-2228230393-4197958046',
        'samba_rid_start' => (int) (getenv('LDAP_SAMBA_RID_START') ?: 1025),
        'shadow_expire' => 1,
        'active_shadow_expire' => -1,
        'shadow_flag' => 0,
        'shadow_inactive' => 0,
        'shadow_max' => 99999,
        'shadow_min' => 0,
        'shadow_warning' => 7,
    ],
];