<?php

/**
 * Session Configuration
 *
 * Returns PHP session settings. Applied by Session.php (INIT-010) during
 * Bootstrap initialisation before session_start() is called.
 *
 * Security requirements (ADR-005, DBP v1.0 Ch.6):
 *  - HttpOnly: true      — JS cannot access the session cookie
 *  - Secure: true        — Cookie sent over HTTPS only (set false for local HTTP dev)
 *  - SameSite: Strict    — Protects against CSRF via cookie
 *  - Session files stored in storage/sessions/ (not the system temp dir)
 *
 * Timeout rules per AUTH-004:
 *  - Admin:      absolute 8h  + inactivity 2h
 *  - Couple:     absolute 24h + inactivity 2h
 *  - Crew:       absolute 12h + inactivity 2h
 *
 * @package Inveetaire
 * @ref     DBP v1.0 Ch.6, ADR-005, MIB AUTH-004
 */

return [

    /*
    |--------------------------------------------------------------------------
    | Session Cookie Name
    |--------------------------------------------------------------------------
    */
    'name' => $_ENV['SESSION_NAME'] ?? 'inveetaire_session',

    /*
    |--------------------------------------------------------------------------
    | Session Save Path
    |--------------------------------------------------------------------------
    | PHP will write session files here instead of the system temp directory.
    | Must be an absolute path and writable by the web server.
    | Populated from STORAGE_SESSIONS in .env via storage config.
    */
    'save_path' => $_ENV['STORAGE_SESSIONS'] ?? '',

    /*
    |--------------------------------------------------------------------------
    | Absolute Timeouts (in seconds)
    |--------------------------------------------------------------------------
    | Maximum session lifetime per role, regardless of activity.
    | After this time, the session is invalidated even if the user is active.
    */
    'timeout' => [
        'admin'  => (int) ($_ENV['SESSION_TIMEOUT_ADMIN']  ?? 28800),   // 8 hours
        'couple' => (int) ($_ENV['SESSION_TIMEOUT_COUPLE'] ?? 86400),   // 24 hours
        'crew'   => (int) ($_ENV['SESSION_TIMEOUT_CREW']   ?? 43200),   // 12 hours
    ],

    /*
    |--------------------------------------------------------------------------
    | Inactivity Timeout (in seconds)
    |--------------------------------------------------------------------------
    | Applies to all roles. If no request is made within this window,
    | the session is invalidated on the next request.
    */
    'inactivity_timeout' => (int) ($_ENV['SESSION_INACTIVITY_TIMEOUT'] ?? 1800),  // 30 minutes

    /*
    |--------------------------------------------------------------------------
    | Cookie Security Settings
    |--------------------------------------------------------------------------
    | Applied via session_set_cookie_params() in Session.php (INIT-010).
    */
    'cookie' => [
        'httponly' => true,

        // Set to true in production (requires HTTPS).
        // Set to false for local HTTP development (XAMPP without SSL).
        'secure'   => ($_ENV['APP_ENV'] ?? 'local') === 'production',

        // SameSite=Strict prevents cross-site request forgery via cookies.
        'samesite' => 'Strict',

        // Cookie path — restrict to the application base path.
        'path'     => '/',

        // Cookie domain — empty uses the current domain automatically.
        'domain'   => '',
    ],

    /*
    |--------------------------------------------------------------------------
    | Session Garbage Collection
    |--------------------------------------------------------------------------
    */
    'gc_maxlifetime' => 86400,   // Matches the maximum role timeout (Couple: 24h)
    'gc_probability' => 1,
    'gc_divisor'     => 100,

];
