<?php

/**
 * Supabase Configuration
 *
 * Returns Supabase project credentials read from environment variables.
 * This file follows the same pattern as config/database.php.
 *
 * Architecture rules (DX002A):
 *   - SUPABASE is a cloud mirror ONLY. MySQL remains the source of truth.
 *   - The application NEVER queries Supabase directly for business logic.
 *   - Supabase is used for: mirror, cloud recovery, developer utilities, AI dev.
 *   - The service_role_key MUST NEVER be rendered to the browser.
 *   - Use server-side config() helper to access credentials in services only.
 *
 * Security:
 *   - service_role_key is excluded from any array passed to views.
 *   - All URL/key rendering in views must be masked (see SupabaseService::mask*()).
 *   - Never log credentials.
 *
 * To configure: add the following to your .env file:
 *   SUPABASE_URL=https://your-project-ref.supabase.co
 *   SUPABASE_ANON_KEY=eyJ...
 *   SUPABASE_SERVICE_ROLE_KEY=eyJ...
 *   SUPABASE_PROJECT_REF=your-project-ref
 *   SUPABASE_REGION=ap-southeast-1
 *
 * @package Inveetaire
 * @ref     DX002A
 */

return [

    /*
    |--------------------------------------------------------------------------
    | Supabase Project URL
    |--------------------------------------------------------------------------
    | Format: https://{project-ref}.supabase.co
    | Used as the base URL for REST API calls.
    */
    'url' => $_ENV['SUPABASE_URL'] ?? '',

    /*
    |--------------------------------------------------------------------------
    | Supabase Anonymous Key
    |--------------------------------------------------------------------------
    | Safe for read-only REST API calls. Used for connection tests.
    | This key has Row Level Security applied.
    */
    'anon_key' => $_ENV['SUPABASE_ANON_KEY'] ?? '',

    /*
    |--------------------------------------------------------------------------
    | Supabase Service Role Key
    |--------------------------------------------------------------------------
    | SECURITY CRITICAL — NEVER render this value to the browser.
    | Used only in server-side services for privileged operations.
    | This key bypasses Row Level Security.
    */
    'service_role_key' => $_ENV['SUPABASE_SERVICE_ROLE_KEY'] ?? '',

    /*
    |--------------------------------------------------------------------------
    | Project Reference
    |--------------------------------------------------------------------------
    | The short project identifier (e.g. "abcdefghijklmnop").
    | Used to construct Supabase Management API URLs.
    */
    'project_ref' => $_ENV['SUPABASE_PROJECT_REF'] ?? '',

    /*
    |--------------------------------------------------------------------------
    | Region
    |--------------------------------------------------------------------------
    | The Supabase hosting region (e.g. "ap-southeast-1").
    | Informational — displayed in the Developer Console.
    */
    'region' => $_ENV['SUPABASE_REGION'] ?? '',

    /*
    |--------------------------------------------------------------------------
    | REST API Base Path
    |--------------------------------------------------------------------------
    | Standard Supabase REST API path. Do not change unless Supabase changes it.
    */
    'rest_path' => '/rest/v1',

    /*
    |--------------------------------------------------------------------------
    | HTTP Timeout (seconds)
    |--------------------------------------------------------------------------
    | Timeout for Supabase API calls. Keep low to avoid blocking requests.
    */
    'timeout' => 8,

    /*
    |--------------------------------------------------------------------------
    | Supabase Personal Access Token (DX002B)
    |--------------------------------------------------------------------------
    | SECURITY CRITICAL — NEVER render this value to the browser.
    | Required for SQL execution via the Supabase Management API.
    | Generate at: https://supabase.com/dashboard/account/tokens
    | Without this, DX002B operates in SQL Export Mode only.
    */
    'access_token' => $_ENV['SUPABASE_ACCESS_TOKEN'] ?? '',

    /*
    |--------------------------------------------------------------------------
    | Management API Base URL
    |--------------------------------------------------------------------------
    | Supabase Management API base. Do not change.
    | Used for: database query execution, schema reading.
    */
    'management_api_url' => 'https://api.supabase.com/v1',

];
