<?php

declare(strict_types=1);

return [
    /*
    |--------------------------------------------------------------------------
    | Application Environment
    |--------------------------------------------------------------------------
    |
    | Use "local" for development and "production" for live deployments.
    | APP_DEBUG controls whether errors are displayed in browser.
    |
    */
    // Defaults are the SAFE ones. This file ships inside every bundle and the
    // installer does not rewrite it, so whatever is written here is what a fresh
    // live install runs with — and on shared hosting (cPanel/DirectAdmin) very few
    // owners will ever set an environment variable. Defaulting to development
    // meant a brand-new install showed PHP errors, stack traces and absolute
    // paths to any visitor.
    //
    // For local development set APP_DEBUG=true in the environment, or edit this
    // file on the dev machine only — config/ is never overwritten by an update.
    'env' => getenv('APP_ENV') ?: 'production',

    'debug' => filter_var(getenv('APP_DEBUG') ?: false, FILTER_VALIDATE_BOOLEAN),

    /*
    |--------------------------------------------------------------------------
    | Default timezone
    |--------------------------------------------------------------------------
    |
    | Applied to PHP (date_default_timezone_set) AND the MySQL session
    | (core/DB.php aligns SET time_zone to this offset) so every timestamp —
    | PHP date() and MySQL NOW()/CURRENT_TIMESTAMP — reads on one clock. Set
    | to your local zone; Nepal is 'Asia/Kathmandu' (+05:45). Override per host
    | with the APP_TIMEZONE environment variable. Empty = leave PHP as-is.
    |
    */
    'timezone' => getenv('APP_TIMEZONE') ?: 'Asia/Kathmandu',

    'session' => [
        // NULL when unset, deliberately: public/index.php reads
        // `$appConfig['session']['secure'] ?? $isHttps`, so a null lets the
        // request's own scheme decide. Returning a literal `false` here silently
        // defeated that fallback and left the session cookie un-Secure even on
        // HTTPS — the cookie would then also travel over plain HTTP.
        // An EMPTY value counts as unset, not as `false`. Control panels and
        // container configs routinely define a variable with no value, and
        // reading that as an explicit "false" would pin the cookie un-Secure on
        // an HTTPS site — the exact bug this null is here to avoid.
        'secure' => (static function () {
            $v = getenv('SESSION_SECURE');
            return ($v === false || $v === '') ? null : filter_var($v, FILTER_VALIDATE_BOOLEAN);
        })(),
        'samesite' => getenv('SESSION_SAMESITE') ?: 'Lax',
    ],
];
