<?php

return [
    'brand_name' => env('REWARDS_BRAND_NAME', config('app.name', 'Basketloot')),
    'domain' => env('REWARDS_DOMAIN', 'basketloot.com'),
    'tagline' => env('REWARDS_TAGLINE', 'Explore offers, complete online quests, and earn rewards with BasketLoot.'),
    'points_name' => env('REWARDS_POINTS_NAME', 'coins'),
    'coins_per_usd' => max(1, (float) env('REWARDS_COINS_PER_USD', 1000)),
    'support_email' => env('REWARDS_SUPPORT_EMAIL', 'support@basketloot.com'),
    'primary_color' => env('REWARDS_PRIMARY_COLOR', '#7CFF5B'),
    'accent_color' => env('REWARDS_ACCENT_COLOR', '#4DDCFF'),
    'referral_commission_rate' => (float) env('REWARDS_REFERRAL_COMMISSION_RATE', 0.05),
    'referral_signup_bonus' => (float) env('REWARDS_REFERRAL_SIGNUP_BONUS', 5),
    'provider_offer_fresh_minutes' => (int) env('PROVIDER_OFFER_FRESH_MINUTES', 10),
    'user_offer_refresh_minutes' => (int) env('USER_OFFER_REFRESH_MINUTES', 5),
    'system_api_key' => env('BASKETLOOT_API_KEY'),
    'custom_postback_secret' => env('CUSTOM_POSTBACK_SECRET'),
    'custom_postback_allowed_ips' => array_values(array_filter(array_map(
        'trim',
        explode(',', (string) env('CUSTOM_POSTBACK_ALLOWED_IPS', ''))
    ))),
    'custom_postback_require_timestamp' => filter_var(env('CUSTOM_POSTBACK_REQUIRE_TIMESTAMP', false), FILTER_VALIDATE_BOOLEAN),
    'custom_postback_max_age_seconds' => max(60, (int) env('CUSTOM_POSTBACK_MAX_AGE_SECONDS', 300)),
    'max_offer_reward_points' => max(1, (float) env('REWARDS_MAX_OFFER_POINTS', 1000000)),

    // Only trust the CF-Connecting-IP header when the site actually sits
    // behind Cloudflare; otherwise the header is client-controlled and lets
    // attackers spoof their IP to bypass anti-fraud checks.
    'trust_cloudflare' => (bool) env('TRUST_CLOUDFLARE', false),

    // reCAPTCHA .env fallbacks (admins normally set these in Admin → Settings).
    // Kept in config so they survive `php artisan config:cache` in production.
    'recaptcha_site_key' => env('RECAPTCHA_SITE_KEY'),
    'recaptcha_secret_key' => env('RECAPTCHA_SECRET_KEY'),
];
