<?php

namespace Config;

use CodeIgniter\Config\BaseConfig;

/**
 * Authentication module configuration.
 *
 * All values are safe defaults for an enterprise ERP and can be overridden
 * via .env (e.g. auth.maxLoginAttempts = 10).
 */
class Auth extends BaseConfig
{
    /**
     * Number of consecutive failed login attempts allowed before the
     * account (or IP, depending on $lockoutStrategy) is locked out.
     */
    public int $maxLoginAttempts = 5;

    /**
     * How long (in minutes) an account/IP stays locked out after
     * exceeding $maxLoginAttempts.
     */
    public int $lockoutMinutes = 15;

    /**
     * 'account' locks the specific user account after failed attempts.
     * 'ip' locks the offending IP address instead.
     * 'both' enforces whichever limit is hit first.
     */
    public string $lockoutStrategy = 'both';

    /**
     * Rolling window (in minutes) used when counting failed attempts.
     */
    public int $attemptWindowMinutes = 15;

    /**
     * Minimum password length.
     */
    public int $passwordMinLength = 10;

    /**
     * Require at least one uppercase, one lowercase, one number and
     * one special character in new passwords.
     */
    public bool $passwordRequireMixedCase = true;
    public bool $passwordRequireNumber = true;
    public bool $passwordRequireSpecialChar = true;

    /**
     * Number of previous passwords to check against to prevent reuse.
     * Set to 0 to disable password history checks.
     */
    public int $passwordHistoryLimit = 5;

    /**
     * How long (minutes) a "remember me" token stays valid.
     */
    public int $rememberMeDurationMinutes = 43200; // 30 days

    /**
     * Idle session timeout, in minutes. 0 disables the idle timeout.
     */
    public int $sessionIdleTimeoutMinutes = 30;

    /**
     * How long (minutes) a password reset token remains valid.
     */
    public int $passwordResetTokenTtlMinutes = 60;

    /**
     * Toggle e-mail verification requirement for new accounts.
     */
    public bool $requireEmailVerification = false;

    /**
     * Architecture switch for Two-Factor Authentication. Phase 1 ships the
     * database columns, service hooks and settings UI toggle only; the
     * actual OTP/TOTP delivery is implemented in a later phase.
     */
    public bool $twoFactorEnabled = false;

    /**
     * Route/URI the user is redirected to after a successful login.
     */
    public string $defaultRedirectUrl = '/dashboard';

    /**
     * Fallback for logged-in users who cannot access the dashboard or
     * the page they were denied. Must only require the auth filter.
     */
    public string $accessDeniedRedirectUrl = '/profile';

    /**
     * Route/URI shown to guests attempting to access protected pages.
     */
    public string $loginUrl = '/login';
}
