<?php

declare(strict_types=1);

return [
    'enabled' => (bool) env('API_ENCRYPT_ENABLED', false),
    'scope' => (string) env('API_ENCRYPT_SCOPE', 'off'),
    'algorithm' => (string) env('API_ENCRYPT_ALGORITHM', 'rsa-aes'),
    'key_version' => (string) env('API_ENCRYPT_KEY_VERSION', 'v1'),
    'aes_mode' => (string) env('API_ENCRYPT_AES_MODE', 'AES-256-CBC'),
    'public_key_path' => (string) env('API_ENCRYPT_RSA_PUBLIC_KEY_PATH', runtime_path() . '/keys/api_encrypt_public.pem'),
    'private_key_path' => (string) env('API_ENCRYPT_RSA_PRIVATE_KEY_PATH', runtime_path() . '/keys/api_encrypt_private.pem'),
    'timestamp_tolerance' => (int) env('API_ENCRYPT_TIMESTAMP_TOLERANCE', 300),
    'exclude_paths' => [
        '/api/openapi',
        '/api/openapi.json',
        '/adminapi/openapi',
        '/adminapi/openapi.json',
        '/api/system/security/api-encrypt/public-key',
        '/adminapi/system/security/api-encrypt/public-key',
        '/upload',
    ],
];