<?php

return [
    'landing_url' => (static function (): string {
        $url = trim((string) env('ZT_LANDING_URL', 'https://zthosting.eagale.xyz'));
        if (! preg_match('~^https?://~i', $url)) {
            $url = 'https://'.$url;
        }
        return rtrim($url, '/');
    })(),
    // Official WHMCS external API endpoint. ZT_API_BASE_URL remains only as
    // backward-compatible fallback while migrating away from the old wrapper.
    'api_base_url' => env('WHMCS_API_URL', env('ZT_API_BASE_URL', 'https://api.zthosting.com/includes/api.php')),

    'whmcs' => [
        // WHMCS API Credentials screen uses Identifier/Secret. Use
        // WHMCS_AUTH_STYLE=identifier for the official documented payload.
        // username_password and both are kept only for debugging compatibility.
        'identifier' => env('WHMCS_API_IDENTIFIER', env('WHMCS_API_USERNAME')),
        'secret' => env('WHMCS_API_SECRET', env('WHMCS_API_PASSWORD')),
        'username' => env('WHMCS_API_USERNAME'),
        'password' => env('WHMCS_API_PASSWORD'),
        'auth_style' => env('WHMCS_AUTH_STYLE', 'identifier'),
        'access_key' => env('WHMCS_API_ACCESS_KEY'),

        // Optional least-privilege credential used for payment writes.
        // Grant AddInvoicePayment for invoices and AddTransaction for account credit.
        // When these values are empty, the normal WHMCS API credential is used.
        'payment_identifier' => env('WHMCS_PAYMENT_API_IDENTIFIER'),
        'payment_secret' => env('WHMCS_PAYMENT_API_SECRET'),
        'payment_access_key' => env('WHMCS_PAYMENT_API_ACCESS_KEY', env('WHMCS_API_ACCESS_KEY')),

        // Native WHMCS client-area root used for SSO redirects.
        // Set this to the real WHMCS URL, not the old WordPress/bridge cart URL.
        // Example: WHMCS_CLIENTAREA_URL=https://my.zthosting.com
        'client_area_url' => env('WHMCS_CLIENTAREA_URL', env('WHMCS_BASE_URL')),

        'connect_timeout' => env('WHMCS_CONNECT_TIMEOUT', 3),
        'timeout' => env('WHMCS_TIMEOUT', 8),

        // Temporary diagnostics. Keep enabled only while debugging live WHMCS
        // API access. Credentials are masked in logs; full secrets are never logged.
        'debug_log_enabled' => env('WHMCS_DEBUG_LOG_ENABLED', false),
        'debug_log_response_body' => env('WHMCS_DEBUG_LOG_RESPONSE_BODY', true),
        'debug_body_limit' => env('WHMCS_DEBUG_BODY_LIMIT', 4000),

        // Safe migration mode:
        // disabled = never call WHMCS write APIs.
        // dry_run  = build/log AddClient/AddOrder payloads but do not send them.
        // live     = send allowed write calls to WHMCS.
        'sync_mode' => env('WHMCS_SYNC_MODE', 'dry_run'),
        'block_checkout_on_sync_failure' => env('WHMCS_BLOCK_CHECKOUT_ON_SYNC_FAILURE', false),

        // Keep existing live clients safe. Existing WHMCS clients are only linked
        // by exact email; they are NOT updated unless explicitly enabled.
        'create_missing_clients' => env('WHMCS_CREATE_MISSING_CLIENTS', false),
        'update_existing_clients' => env('WHMCS_UPDATE_EXISTING_CLIENTS', false),
        'create_orders' => env('WHMCS_CREATE_ORDERS', false),
        'auto_accept_orders' => env('WHMCS_AUTO_ACCEPT_ORDERS', false),

        // After PayFast is verified and WHMCS marks the invoice Paid, accept the
        // related Pending order and request service/domain provisioning.
        'provision_paid_orders' => env('WHMCS_PROVISION_PAID_ORDERS', true),
        'provision_send_email' => env('WHMCS_PROVISION_SEND_EMAIL', true),
        // Direct ModuleCreate/DomainRegister is strictly limited to Paid invoice items that WHMCS still reports Pending.
        // Set false for a conservative order-acceptance-only mode.
        'force_provision_paid_pending_items' => env('WHMCS_FORCE_PROVISION_PAID_PENDING_ITEMS', true),
        'reconcile_paid_provisioning_on_manual_refresh' => env('WHMCS_RECONCILE_PAID_PROVISIONING_ON_REFRESH', true),
        'reconcile_paid_invoice_limit' => (int) env('WHMCS_RECONCILE_PAID_INVOICE_LIMIT', 5),

        'default_payment_method' => env('WHMCS_DEFAULT_PAYMENT_METHOD', 'banktransfer'),
        'payment_method_map' => [
            'bank-transfer' => env('WHMCS_PAYMENT_BANK_TRANSFER', env('WHMCS_DEFAULT_PAYMENT_METHOD', 'banktransfer')),
            'jazzcash' => env('WHMCS_PAYMENT_JAZZCASH', env('WHMCS_DEFAULT_PAYMENT_METHOD', 'banktransfer')),
            'easypaisa' => env('WHMCS_PAYMENT_EASYPAISA', env('WHMCS_DEFAULT_PAYMENT_METHOD', 'banktransfer')),
            'payfast' => env('WHMCS_PAYMENT_PAYFAST', env('ZT_PAYFAST_WHMCS_GATEWAY', 'payfast')),
        ],

        // During testing, keep customer emails disabled unless the client wants
        // WHMCS to email invoices immediately.
        'add_order_no_email' => env('WHMCS_ADD_ORDER_NO_EMAIL', true),

        // Set true only if the API role is not assigned to the support departments
        // that clients should be able to use. Prefer assigning departments first.
        'support_ignore_department_assignments' => env('WHMCS_SUPPORT_IGNORE_DEPARTMENT_ASSIGNMENTS', false),
        'billing_department_id' => (int) env('ZT_BILLING_DEPARTMENT_ID', 0),
    ],

    'domain_lookup' => [
        // registry = direct registry WHOIS first, then the existing lookup fallback.
        // registry-only = use registry WHOIS only.
        // legacy = use the previous domain lookup method only.
        'mode' => env('ZT_DOMAIN_CHECK_MODE', 'registry'),
        'cache_ttl' => (int) env('ZT_DOMAIN_WHOIS_CACHE_TTL', 300),
        'socket_timeout' => (int) env('ZT_DOMAIN_WHOIS_SOCKET_TIMEOUT', 3),
        'socket_idle_timeout_ms' => (int) env('ZT_DOMAIN_WHOIS_SOCKET_IDLE_TIMEOUT_MS', 700),
        'http_timeout' => (int) env('ZT_DOMAIN_WHOIS_HTTP_TIMEOUT', 4),

        // Keep the previous no-DNS safety rule available for legacy fallback.
        'trust_no_dns_fallback' => env('ZT_DOMAIN_TRUST_NO_DNS_FALLBACK', false),
    ],

    'products' => [
        // Products in this list are never shown in checkout/store/cart UI.
        // Example: ZT_HIDDEN_PRODUCT_IDS=280,281,329,343
        'hidden_product_ids' => array_values(array_filter(array_map('intval', explode(',', (string) env('ZT_HIDDEN_PRODUCT_IDS', '280,281,329,343'))))),

        // Optional whitelist. When set, WHMCS GetProducts is called with this
        // comma-separated pid list, so unrelated products are not fetched.
        // Example: ZT_ALLOWED_PRODUCT_IDS=101,102,103
        'allowed_product_ids' => array_values(array_filter(array_map('intval', explode(',', (string) env('ZT_ALLOWED_PRODUCT_IDS', ''))))),

        // Debug/migration only. Keep false so the UI does not silently show fake
        // products when the live WHMCS catalog request fails.
        'use_fallback_catalog' => env('ZT_USE_FALLBACK_CATALOG', false),
    ],


    'bank_transfer' => [
        'whatsapp_number' => env('ZT_BANK_TRANSFER_WHATSAPP', '923111045555'),
        'accounts' => [
            [
                'bank' => env('ZT_BANK_1_NAME', 'Soneri Bank'),
                'title' => env('ZT_BANK_1_TITLE', 'Zt Hosting'),
                'iban' => env('ZT_BANK_1_IBAN', 'PK32SONE0001620009037412'),
            ],
            [
                'bank' => env('ZT_BANK_2_NAME', 'JS BANK'),
                'title' => env('ZT_BANK_2_TITLE', 'Zt Hosting'),
                'iban' => env('ZT_BANK_2_IBAN', 'PK66JSBL9599000002625560'),
            ],
        ],
    ],

    'manual_payments' => [
        'bank_channels' => [
            'soneri-bank' => ['name' => env('ZT_BANK_1_NAME', 'Soneri Bank'), 'title' => env('ZT_BANK_1_TITLE', 'Zt Hosting'), 'account' => env('ZT_BANK_1_IBAN', 'PK32SONE0001620009037412'), 'account_label' => 'IBAN'],
            'js-bank' => ['name' => env('ZT_BANK_2_NAME', 'JS BANK'), 'title' => env('ZT_BANK_2_TITLE', 'Zt Hosting'), 'account' => env('ZT_BANK_2_IBAN', 'PK66JSBL9599000002625560'), 'account_label' => 'IBAN'],
            'easypaisa' => ['name' => 'EasyPaisa', 'title' => env('ZT_EASYPAISA_TITLE', 'Zt Hosting'), 'account' => env('ZT_EASYPAISA_NUMBER', ''), 'account_label' => 'Account Number'],
            'jazzcash' => ['name' => 'JazzCash', 'title' => env('ZT_JAZZCASH_TITLE', 'Zt Hosting'), 'account' => env('ZT_JAZZCASH_NUMBER', ''), 'account_label' => 'Account Number'],
        ],
        'methods' => [
            'bank-transfer' => [
                'name' => 'Bank Transfer',
                'accounts' => [
                    ['label' => env('ZT_BANK_1_NAME', 'Soneri Bank'), 'title' => env('ZT_BANK_1_TITLE', 'Zt Hosting'), 'account' => env('ZT_BANK_1_IBAN', 'PK32SONE0001620009037412'), 'account_label' => 'IBAN'],
                    ['label' => env('ZT_BANK_2_NAME', 'JS BANK'), 'title' => env('ZT_BANK_2_TITLE', 'Zt Hosting'), 'account' => env('ZT_BANK_2_IBAN', 'PK66JSBL9599000002625560'), 'account_label' => 'IBAN'],
                ],
            ],
            'easypaisa' => [
                'name' => 'EasyPaisa',
                'accounts' => [['label' => 'EasyPaisa', 'title' => env('ZT_EASYPAISA_TITLE', 'Zt Hosting'), 'account' => env('ZT_EASYPAISA_NUMBER', ''), 'account_label' => 'Account Number']],
            ],
            'jazzcash' => [
                'name' => 'JazzCash',
                'accounts' => [['label' => 'JazzCash', 'title' => env('ZT_JAZZCASH_TITLE', 'Zt Hosting'), 'account' => env('ZT_JAZZCASH_NUMBER', ''), 'account_label' => 'Account Number']],
            ],
        ],
        'max_proof_kb' => (int) env('ZT_PAYMENT_PROOF_MAX_KB', 5120),
    ],

    'credit' => [
        // When enabled, a client must have at least one Active WHMCS order
        // before the portal allows an account-credit deposit.
        'require_approved_order' => env('ZT_CREDIT_REQUIRE_APPROVED_ORDER', true),
    ],

    'payfast' => [
        'enabled' => env('ZT_PAYFAST_ENABLED', false),
        // manual = existing hosted-checkout token request.
        // library = zfhassaan/payfast package getToken() method.
        'driver' => env('ZT_PAYFAST_DRIVER', 'manual'),
        'mode' => env('ZT_PAYFAST_MODE', 'sandbox'), // sandbox or live
        'merchant_id' => env('ZT_PAYFAST_MERCHANT_ID'),
        'secured_key' => env('ZT_PAYFAST_SECURED_KEY'),
        'merchant_name' => env('ZT_PAYFAST_MERCHANT_NAME', 'ZT Hosting'),
        'store_id' => env('ZT_PAYFAST_STORE_ID'),
        // PayFast accepts PKR only. Currency ID 3 and its live rate are read
        // from WHMCS GetCurrencies for every new PayFast checkout.
        'currency_code' => 'PKR',
        'whmcs_pkr_currency_id' => 3,
        'amount_decimals' => (int) env('ZT_PAYFAST_AMOUNT_DECIMALS', 2),
        'token_url' => env('ZT_PAYFAST_TOKEN_URL'),
        'form_post_url' => env('ZT_PAYFAST_FORM_POST_URL'),
        'gateway_name' => env('ZT_PAYFAST_WHMCS_GATEWAY', 'payfast'),
        'checkout_method_aliases' => array_values(array_filter(array_map('trim', explode(',', (string) env('ZT_PAYFAST_CHECKOUT_METHOD_ALIASES', 'payfast,gopayfast'))))),
        'default_mobile' => env('ZT_PAYFAST_DEFAULT_MOBILE', '03000000000'),
        'connect_timeout' => env('ZT_PAYFAST_CONNECT_TIMEOUT', 8),
        'timeout' => env('ZT_PAYFAST_TIMEOUT', 20),
        // Writes masked PayFast requests, responses and exceptions to
        // payfast_debug_logs. Disable after troubleshooting if not required.
        'debug_enabled' => env('ZT_PAYFAST_DEBUG_ENABLED', true),
        'debug_max_bytes' => (int) env('ZT_PAYFAST_DEBUG_MAX_BYTES', 50000),
        'success_codes' => array_values(array_filter(array_map('trim', explode(',', (string) env('ZT_PAYFAST_SUCCESS_CODES', '000,00'))))),
        'require_callback_amounts' => env('ZT_PAYFAST_REQUIRE_CALLBACK_AMOUNTS', true),
        'require_callback_currency' => env('ZT_PAYFAST_REQUIRE_CALLBACK_CURRENCY', true),
        'require_callback_order_date' => env('ZT_PAYFAST_REQUIRE_CALLBACK_ORDER_DATE', false),
        'whmcs_retry_max_attempts' => (int) env('ZT_PAYFAST_WHMCS_RETRY_MAX_ATTEMPTS', 12),
    ],

    'currency' => [
        'default' => env('APP_DEFAULT_CURRENCY', 'USD'),
        // If IP detection fails, international/default should stay USD. PKR is
        // only selected when the visitor country resolves to PK.
        'fallback' => env('CURRENCY_FALLBACK', 'USD'),
        'local_country_code' => env('LOCAL_COUNTRY_CODE', 'PK'),
        'local_currency' => env('LOCAL_CURRENCY', 'PKR'),
        'detection_enabled' => env('CURRENCY_DETECTION_ENABLED', true),
        'account_priority' => env('CURRENCY_ACCOUNT_PRIORITY', false),

        // Guests are geo-resolved. Registration writes the selected currency
        // into WHMCS using its numeric currency id, then the account is locked.
        // Authenticated users never switch because of a later VPN/IP change.
        'lock_on_registration' => env('CURRENCY_LOCK_ON_REGISTRATION', true),
        // Kept for backward compatibility with older migrations/settings.
        'lock_after_first_order' => env('CURRENCY_LOCK_AFTER_FIRST_ORDER', true),
        'allow_switch_before_first_order' => env('CURRENCY_ALLOW_SWITCH_BEFORE_FIRST_ORDER', true),
        'domain_usd_to_pkr_rate' => (float) env('DOMAIN_USD_TO_PKR_RATE', 285),
        'domain_pkr_round_to' => (int) env('DOMAIN_PKR_ROUND_TO', 10),
    ],

    'ip_lookup' => [
        'enabled' => env('IP_LOOKUP_ENABLED', true),

        // ipwho.is default:
        // IP_LOOKUP_URL=https://ipwho.is/{ip}
        // IP_LOOKUP_SERVER_URL=https://ipwho.is/
        //
        // ipapi.co alternative:
        // IP_LOOKUP_URL=https://ipapi.co/{ip}/json/
        // IP_LOOKUP_SERVER_URL=https://ipapi.co/json/
        'url' => env('IP_LOOKUP_URL', 'https://ipwho.is/{ip}'),
        'server_url' => env('IP_LOOKUP_SERVER_URL', 'https://ipwho.is/'),

        // Browser-side lookup is used only to fix localhost/browser-VPN testing.
        // A Chrome VPN extension changes browser requests, but PHP server-side
        // HTTP calls still use the machine/server network.
        'browser_detection_enabled' => env('IP_LOOKUP_BROWSER_DETECTION_ENABLED', true),
        'browser_url' => env('IP_LOOKUP_BROWSER_URL', 'https://ipapi.co/json/'),

        // Useful for local VPN testing. On localhost Laravel sees 127.0.0.1,
        // not the browser public IP. This makes local testing use the server
        // public/VPN IP instead of forcing PKR.
        'use_server_ip_for_local' => env('IP_LOOKUP_USE_SERVER_IP_FOR_LOCAL', true),

        // Optional test override. Example: IP_LOOKUP_LOCAL_TEST_IP=8.8.8.8
        'local_test_ip' => env('IP_LOOKUP_LOCAL_TEST_IP'),

        // Optional hard override for debugging only. Example: IP_LOOKUP_FORCE_COUNTRY=US
        'force_country' => env('IP_LOOKUP_FORCE_COUNTRY'),
    ],

    'cache' => [
        // Global read-cache switch. Keep true in production for performance.
        // Set ZT_CACHE_ENABLED=false in .env while developing/debugging WHMCS
        // data so products, TLDs, payment methods, tickets and IP lookups are
        // fetched fresh. Mutation/write actions remain non-cacheable either way.
        'enabled' => env('ZT_CACHE_ENABLED', true),
        'products_ttl' => env('ZT_PRODUCTS_CACHE_TTL', 3600),
        'tld_pricing_ttl' => env('ZT_TLD_PRICING_CACHE_TTL', 21600),
        // Cache only definite availability results briefly to speed repeated
        // checks. Unknown/error results are never cached.
        'domain_availability_ttl' => env('ZT_DOMAIN_AVAILABILITY_CACHE_TTL', 120),
        'currencies_ttl' => (int) env('ZT_CACHE_CURRENCIES_TTL', 3600),
        'payment_methods_ttl' => env('ZT_PAYMENT_METHODS_CACHE_TTL', 3600),
        'support_departments_ttl' => env('ZT_SUPPORT_DEPARTMENTS_CACHE_TTL', 900),
        'support_statuses_ttl' => env('ZT_SUPPORT_STATUSES_CACHE_TTL', 900),
        'support_tickets_ttl' => env('ZT_SUPPORT_TICKETS_CACHE_TTL', 60),
        'support_ticket_ttl' => env('ZT_SUPPORT_TICKET_CACHE_TTL', 30),
        'ip_country_ttl' => env('ZT_IP_COUNTRY_CACHE_TTL', 3600),
    ],


    'mirror' => [
        // Controls read-side WHMCS mirror refresh into Laravel tables.
        'enabled' => env('ZT_WHMCS_MIRROR_ENABLED', true),
        'refresh_on_page_load' => env('ZT_WHMCS_MIRROR_REFRESH_ON_PAGE_LOAD', true),
        'refresh_ttl' => env('ZT_WHMCS_MIRROR_REFRESH_TTL', 300),
        'invoices_limit' => env('ZT_WHMCS_MIRROR_INVOICES_LIMIT', 50),
        'services_limit' => env('ZT_WHMCS_MIRROR_SERVICES_LIMIT', 50),
        'domains_limit' => env('ZT_WHMCS_MIRROR_DOMAINS_LIMIT', 50),
    ],


    'profile' => [
        // WHMCS is the real auth/source account. Keep local password/account
        // deletion UI disabled unless you intentionally implement equivalent
        // WHMCS-side actions.
        'local_password_update_enabled' => env('ZT_LOCAL_PASSWORD_UPDATE_ENABLED', false),
        'local_account_delete_enabled' => env('ZT_LOCAL_ACCOUNT_DELETE_ENABLED', false),
    ],

    'rate_limits' => [
        'domain_search_per_minute' => env('ZT_RATE_LIMIT_DOMAIN_SEARCH_PER_MINUTE', 20),
        'checkout_per_minute' => env('ZT_RATE_LIMIT_CHECKOUT_PER_MINUTE', 10),
        'tickets_per_minute' => env('ZT_RATE_LIMIT_TICKETS_PER_MINUTE', 8),
    ],

    'public_api' => [
        // Comma-separated list of frontend origins allowed to call the public
        // domain lookup API from browser JavaScript. Use the exact Next.js
        // domain in production instead of '*'.
        // Example: ZT_PUBLIC_API_ALLOWED_ORIGINS=https://www.zthosting.com,https://landing.example.com
        'allowed_origins' => env('ZT_PUBLIC_API_ALLOWED_ORIGINS', '*'),
    ],

    'domain_suggestions' => [
        'max_results' => env('ZT_DOMAIN_SUGGESTION_RESULTS', 6),
        'max_checks' => env('ZT_DOMAIN_SUGGESTION_CHECKS', 10),
        'preferred_tlds' => ['com', 'net', 'org', 'info', 'biz', 'pk', 'com.pk'],
        'brand_tlds' => ['com', 'net', 'cloud', 'shop', 'online', 'info', 'me'],
        'brand_max_checks' => env('ZT_DOMAIN_BRAND_CHECKS', 10),
        'name_affixes' => [
            '{name}online',
            'my{name}',
            'get{name}',
            '{name}host',
            '{name}web',
            'the{name}',
        ],
    ],
];
