<?php

use App\Helpers\Helper;
use App\Helpers\IconHelper;
use App\Helpers\StorageHelper;
use App\Providers\AppServiceProvider;
use App\Providers\BladeServiceProvider;
use App\Providers\BreadcrumbsServiceProvider;
use App\Providers\EventServiceProvider;
use App\Providers\LivewireServiceProvider;
use App\Providers\RouteServiceProvider;
use App\Providers\SamlServiceProvider;
use App\Providers\SettingsServiceProvider;
use App\Providers\SnipeTranslationServiceProvider;
use Illuminate\Auth\AuthServiceProvider;
use Illuminate\Auth\Passwords\PasswordResetServiceProvider;
use Illuminate\Broadcasting\BroadcastServiceProvider;
use Illuminate\Bus\BusServiceProvider;
use Illuminate\Cache\CacheServiceProvider;
use Illuminate\Cookie\CookieServiceProvider;
use Illuminate\Database\DatabaseServiceProvider;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Encryption\EncryptionServiceProvider;
use Illuminate\Filesystem\FilesystemServiceProvider;
use Illuminate\Foundation\Providers\ConsoleSupportServiceProvider;
use Illuminate\Foundation\Providers\FoundationServiceProvider;
use Illuminate\Hashing\HashServiceProvider;
use Illuminate\Mail\MailServiceProvider;
use Illuminate\Notifications\NotificationServiceProvider;
use Illuminate\Pagination\PaginationServiceProvider;
use Illuminate\Pipeline\PipelineServiceProvider;
use Illuminate\Queue\QueueServiceProvider;
use Illuminate\Redis\RedisServiceProvider;
use Illuminate\Session\SessionServiceProvider;
use Illuminate\Support\Facades\Artisan;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Blade;
use Illuminate\Support\Facades\Bus;
use Illuminate\Support\Facades\Cache;
use Illuminate\Support\Facades\Config;
use Illuminate\Support\Facades\Cookie;
use Illuminate\Support\Facades\Crypt;
use Illuminate\Support\Facades\Date;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Event;
use Illuminate\Support\Facades\File;
use Illuminate\Support\Facades\Gate;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Lang;
use Illuminate\Support\Facades\Log;
use Illuminate\Support\Facades\Mail;
use Illuminate\Support\Facades\Notification;
use Illuminate\Support\Facades\Password;
use Illuminate\Support\Facades\Queue;
use Illuminate\Support\Facades\Redirect;
use Illuminate\Support\Facades\Redis;
use Illuminate\Support\Facades\Request;
use Illuminate\Support\Facades\Response;
use Illuminate\Support\Facades\Route;
use Illuminate\Support\Facades\Schema;
use Illuminate\Support\Facades\Session;
use Illuminate\Support\Facades\Storage;
use Illuminate\Support\Facades\URL;
use Illuminate\Support\Facades\Validator;
use Illuminate\Support\Facades\View;
use Illuminate\Validation\ValidationServiceProvider;
use Illuminate\View\ViewServiceProvider;
use Intervention\Image\ImageServiceProvider;
use Laravel\Passport\PassportServiceProvider;
use Laravel\Socialite\Facades\Socialite;
use Laravel\Socialite\SocialiteServiceProvider;
use Laravel\Tinker\TinkerServiceProvider;
use PragmaRX\Google2FALaravel\Facade;
use PragmaRX\Google2FALaravel\ServiceProvider;
use Spatie\Backup\BackupServiceProvider;
use Unicodeveloper\DumbPassword\DumbPasswordServiceProvider;

/*
 |--------------------------------------------------------------------------
 | DO NOT EDIT THIS FILE DIRECTLY.
 |--------------------------------------------------------------------------
 | This file reads from your .env configuration file and should not
 | be modified directly.
*/

return [

    /*
    |--------------------------------------------------------------------------
    | Application Name
    |--------------------------------------------------------------------------
    |
    | This value is the name of your application. This value is used when the
    | framework needs to place the application's name in a notification or
    | any other location as required by the application or its packages.
    */

    'name' => env('SITE_NAME', 'Snipe-IT'),

    /*
    |--------------------------------------------------------------------------
    | Application Environment
    |--------------------------------------------------------------------------
    |
    | This value determines the "environment" your application is currently
    | running in. This may determine how you prefer to configure various
    | services your application utilizes. Set this in your ".env" file.
    |
    */

    'env' => env('APP_ENV', 'production'),

    /*
    |--------------------------------------------------------------------------
    | Result Limit
    |--------------------------------------------------------------------------
    |
    | This value determines the max number of results to return, even if a higher limit
    | is passed in the API request. This is done to prevent server timeouts when
    | custom scripts are requesting 100k assets at a time.
    |
    */

    'max_results' => env('MAX_RESULTS', 500),

    /*
    |--------------------------------------------------------------------------
    | Application Debug Mode
    |--------------------------------------------------------------------------
    |
    | When your application is in debug mode, detailed error messages with
    | stack traces will be shown on every error that occurs within your
    | application. If disabled, a simple generic error page is shown.
    |
    */

    'debug' => env('APP_DEBUG', false),
    'warn_debug' => env('WARN_DEBUG', true),

    /*
    |--------------------------------------------------------------------------
    | Application URL
    |--------------------------------------------------------------------------
    |
    | This URL is used by the console to properly generate URLs when using
    | the Artisan command line tool. You should set this to the root of
    | your application so that it is used when running Artisan tasks.
    |
    */

    'url' => env('APP_URL', 'http://localhost'),

    /*
    |--------------------------------------------------------------------------
    | Application Timezone
    |--------------------------------------------------------------------------
    |
    | Here you may specify the default timezone for your application, which
    | will be used by the PHP date and date-time functions. We have gone
    | ahead and set this to a sensible default for you out of the box.
    |
    */

    'timezone' => env('APP_TIMEZONE', 'UTC'),

    /*
    |--------------------------------------------------------------------------
    | Application Locale Configuration
    |--------------------------------------------------------------------------
    |
    | The application locale determines the default locale that will be used
    | by the translation service provider. You are free to set this value
    | to any of the locales which will be supported by the application.
    |
    */

    'locale' => env('APP_LOCALE', 'en-US'),

    /*
    |--------------------------------------------------------------------------
    | Application Fallback Locale
    |--------------------------------------------------------------------------
    |
    | The fallback locale determines the locale to use when the current one
    | is not available. You may change the value to correspond to any of
    | the language folders that are provided through your application.
    |
    */

    'fallback_locale' => env('FALLBACK_APP_LOCALE', 'en-US'),

    /*
    |--------------------------------------------------------------------------
    | Encryption Key
    |--------------------------------------------------------------------------
    |
    | This key is used by the Illuminate encrypter service and should be set
    | to a random, 32 character string, otherwise these encrypted strings
    | will not be safe. Please do this before deploying an application!
    |
    */

    'key' => env('APP_KEY'),

    'cipher' => env('APP_CIPHER', 'AES-256-CBC'),

    /*
    |--------------------------------------------------------------------------
    | Default Storage path for private uploads
    |--------------------------------------------------------------------------
    | This is the path for any uploaded files that have to be run through the
    | auth system to ensure they are not visible to the public. These should be
    | stored somewhere outside of the web root so that an unauthenticated user
    | cannot access them.
    |
    | For example: license keys, contracts, etc.
    |
    */

    'private_uploads' => storage_path().'/private_uploads',

    /*
   |--------------------------------------------------------------------------
   | ALLOW I-FRAMING
   |--------------------------------------------------------------------------
   |
   | Normal users will never need to edit this. This option lets you run
   | Snipe-IT within an I-Frame, which is normally disabled by default for
   | security reasons, to prevent clickjacking. It should normally be set to false.
   |
   */

    'allow_iframing' => env('ALLOW_IFRAMING', false),

    /*
   |--------------------------------------------------------------------------
   | ALLOW INTERNAL WEBHOOK TARGETS
   |--------------------------------------------------------------------------
   |
   | By default the webhook endpoint validator refuses URLs that resolve to
   | loopback, link-local, RFC-1918, or otherwise-non-public IPs. This
   | prevents a super-admin (or someone who has taken over a super-admin
   | account) from turning the outbound notification path into an SSRF
   | primitive against internal services or cloud metadata endpoints.
   |
   | Some operators legitimately run their own webhook receiver on the same
   | private network as Snipe-IT (self-hosted Mattermost, Rocket.Chat, an
   | internal ChatOps bot, etc.). Setting this to true re-enables outbound
   | requests to those addresses. Scheme restrictions (http/https only) are
   | still enforced. Leave this off unless you know you need it.
   |
   */
    'webhook_allow_internal_targets' => env('WEBHOOK_ALLOW_INTERNAL_TARGETS', false),

    /*
   |--------------------------------------------------------------------------
   | LOG AUTHED USER HEADER
   |--------------------------------------------------------------------------
   |
   | This is an additional header that can be enabled to include the authenticated user's ID
   | in the response headers of each request. This can be useful for debugging and auditing purposes,
   | but it may also expose sensitive information if not used carefully.
   | It should normally be set to false unless you have a specific need for it and
   | understand the security implications.
   |
   */

    'authorized_user_header' => env('INCLUDE_AUTHED_USER_HEADER', false),

    /*
    |--------------------------------------------------------------------------
    | ENABLE HTTP Strict Transport Security (HSTS)
    |--------------------------------------------------------------------------
    |
    | This is set to default false for backwards compatibilty but should be
    | set to true if the hosting environment allows it.
    |
    | See https://scotthelme.co.uk/hsts-the-missing-link-in-tls/
    |
    */

    'enable_hsts' => env('ENABLE_HSTS', false),

    /*
    |--------------------------------------------------------------------------
    | REFERRER-POLICY
    |--------------------------------------------------------------------------
    |
    | This is an additional security header that browsers use to determine
    | whether they should report back URL referrer information.
    |
    | Read more: https://www.w3.org/TR/referrer-policy/
    |
    */

    'referrer_policy' => env('REFERRER_POLICY', 'same-origin'),

    /*
    |--------------------------------------------------------------------------
    | CSP
    |--------------------------------------------------------------------------
    |
    | Disable the content security policy that restricts what scripts, images
    | and styles can load. (This should be left as false if you don't know
    | what this means.)
    |
    | Read more: https://www.w3.org/TR/CSP/
    | Read more: https://content-security-policy.com
    |
    */

    'enable_csp' => env('ENABLE_CSP', true),

    'additional_csp_urls' => env('ADDITIONAL_CSP_URLS', ''),

    /*
    |--------------------------------------------------------------------------
    |  Require SAML Login
    |--------------------------------------------------------------------------
    |
    | Disable the ability to login via form login, and disables the 'nosaml'
    | workaround. It requires all logins to process via SAML login.
    | (This is for high security setups. If your SAML configuration is not
    | working, this option should be set to false. This option is not needed
    | to successfully configure SAML authentication.)
    |
    */

    'require_saml' => env('REQUIRE_SAML', false),

    /*
    |--------------------------------------------------------------------------
    |  SAML KEYS
    |--------------------------------------------------------------------------
    |
    | This is the size of the keys used by openssl_pkey_new for SAML authentication.
    | The default is 2048 bits, but this can be changed to 3072 or 4096 bits
    | for higher security. Note that this will increase the time it takes to
    | generate the keys, so it is not recommended to set this to a very high value
    | unless you have a specific need for it.
    |
    | The European Commission now requires at least 3072-bit keys for new SAML certificates
    | @link https://github.com/grokability/snipe-it/issues/17386
    */

    'saml_key_size' => env('SAML_KEY_SIZE', 2048),

    /*
    |--------------------------------------------------------------------------
    | Demo Mode Lockdown
    |--------------------------------------------------------------------------
    |
    | Normal users will never need to edit this. This option lets you run a
    | version of Snipe-IT with limited functionality to prevent demo abuse.
    |
    */

    'lock_passwords' => env('APP_LOCKED', false),

    /*
    |--------------------------------------------------------------------------
    | Allow test buttons to target private / loopback IPs
    |--------------------------------------------------------------------------
    |
    | Various admin screens (LDAP wizard, Google OAuth, webhook config, etc.)
    | expose "Test" buttons that fire a real network request to a user-
    | supplied host. Without a guard these are SSRF / port-scanning vectors:
    | a superadmin (compromised account, insider, or SaaS tenant) could
    | probe internal-only services, cloud metadata endpoints (169.254.169.254),
    | loopback, etc. and read the distinguishing error responses to
    | enumerate them.
    |
    | Default: false. The test helpers resolve the hostname and reject any
    | URL that lands on a private / loopback / link-local / reserved range.
    |
    | Set to true ONLY when the Snipe-IT installation is legitimately
    | pointed at services on the same private network (self-hosted on-prem
    | alongside internal AD/Slack/webhooks is the typical case). Never
    | enable on hosted / multi-tenant deployments.
    |
    */

    'test_allow_private_ips' => env('TEST_ALLOW_PRIVATE_IPS', false),

    /*
    |--------------------------------------------------------------------------
    | Superuser Impersonation
    |--------------------------------------------------------------------------
    |
    | Comma-separated list of usernames allowed to impersonate other users.
    | Users in this list must ALSO be superusers. Empty or unset means the
    | feature is completely off. Wrap usernames that contain commas in double
    | quotes. Example: ALLOW_USER_IMPERSONATION=admin,"jane, doe"
    |
    */

    'user_impersonation_usernames' => (function () {
        $raw = env('ALLOW_USER_IMPERSONATION', '');

        // Reject anything that isn't a string. env() converts literal "true"/"false"/"null"/etc.
        // to PHP bool/null, which would otherwise stringify to garbage tokens.
        if (! is_string($raw) || trim($raw) === '') {
            return [];
        }

        $usernames = [];
        $seen = [];
        foreach (str_getcsv($raw, ',', '"', '\\') as $token) {
            $token = trim((string) $token);
            $lower = mb_strtolower($token);
            if ($token !== '' && ! isset($seen[$lower])) {
                $usernames[] = $token;
                $seen[$lower] = true;
            }
        }

        return $usernames;
    })(),

    /*
    |--------------------------------------------------------------------------
    | Minimum PHP version
    |--------------------------------------------------------------------------
    |
    | Do not change this variable.
    |
    */

    'min_php' => '8.2.0',

    /*
    |--------------------------------------------------------------------------
    | Autoloaded Service Providers
    |--------------------------------------------------------------------------
    |
    | The service providers listed here will be automatically loaded on the
    | request to your application. Feel free to add your own services to
    | this array to grant expanded functionality to your applications.
    |
    */

    'providers' => [

        /*
         * Laravel Framework Service Providers...
         */
        AuthServiceProvider::class,
        BroadcastServiceProvider::class,
        BusServiceProvider::class,
        CacheServiceProvider::class,
        ConsoleSupportServiceProvider::class,
        CookieServiceProvider::class,
        DatabaseServiceProvider::class,
        EncryptionServiceProvider::class,
        FilesystemServiceProvider::class,
        FoundationServiceProvider::class,
        HashServiceProvider::class,
        MailServiceProvider::class,
        NotificationServiceProvider::class,
        PaginationServiceProvider::class,
        PipelineServiceProvider::class,
        QueueServiceProvider::class,
        RedisServiceProvider::class,
        PasswordResetServiceProvider::class,
        SessionServiceProvider::class,
        SnipeTranslationServiceProvider::class, // we REPLACE the default Laravel translator with our own
        ValidationServiceProvider::class,
        ViewServiceProvider::class,

        /*
         * Package Service Providers...
         */

        ImageServiceProvider::class,
        BackupServiceProvider::class,
        ServiceProvider::class,
        PassportServiceProvider::class,
        TinkerServiceProvider::class,
        DumbPasswordServiceProvider::class,
        Eduardokum\LaravelMailAutoEmbed\ServiceProvider::class,
        SocialiteServiceProvider::class,
        /*
        * Application Service Providers...
        */
        AppServiceProvider::class,
        App\Providers\AuthServiceProvider::class,
        EventServiceProvider::class,
        RouteServiceProvider::class,
        SettingsServiceProvider::class,
        App\Providers\ValidationServiceProvider::class,

        /*
        * Custom Service Providers...
        */
        BladeServiceProvider::class,
        LivewireServiceProvider::class,
        SamlServiceProvider::class,
        BreadcrumbsServiceProvider::class,

    ],

    /*
    |--------------------------------------------------------------------------
    | Class Aliases
    |--------------------------------------------------------------------------
    |
    | This array of class aliases will be registered when this application
    | is started. However, feel free to register as many as you wish as
    | the aliases are "lazy" loaded so they don't hinder performance.
    |
    */

    'aliases' => [

        'App' => Illuminate\Support\Facades\App::class,
        'Artisan' => Artisan::class,
        'Auth' => Auth::class,
        'Blade' => Blade::class,
        'Bus' => Bus::class,
        'Cache' => Cache::class,
        'Config' => Config::class,
        'Cookie' => Cookie::class,
        'Crypt' => Crypt::class,
        'Date' => Date::class,
        'DB' => DB::class,
        'Eloquent' => Model::class,
        'Event' => Event::class,
        'File' => File::class,
        'Gate' => Gate::class,
        'Hash' => Hash::class,
        'Lang' => Lang::class,
        'Log' => Log::class,
        'Mail' => Mail::class,
        'Notification' => Notification::class,
        'Password' => Password::class,
        'Queue' => Queue::class,
        'Redirect' => Redirect::class,
        'Redis' => Redis::class,
        'Request' => Request::class,
        'Response' => Response::class,
        'Route' => Route::class,
        'Schema' => Schema::class,
        'Session' => Session::class,
        'Storage' => Storage::class,
        'URL' => URL::class,
        'Validator' => Validator::class,
        'View' => View::class,
        'Google2FA' => Facade::class,
        'Image' => ImageServiceProvider::class,
        'Carbon' => Carbon\Carbon::class,
        'Helper' => Helper::class,
        'StorageHelper' => StorageHelper::class,
        'Icon' => IconHelper::class,
        'Socialite' => Socialite::class,

    ],

    /*
    |--------------------------------------------------------------------------
    | API Throttling
    |--------------------------------------------------------------------------
    |
    | This value determines the number of API requests permitted per minute
    |
    */

    'api_throttle_per_minute' => env('API_THROTTLE_PER_MINUTE', 120),

    /*
    |--------------------------------------------------------------------------
    | Allow Web-Based Purge
    |--------------------------------------------------------------------------
    |
    | This sets whether or not to allow superadmins to purge deleted data
    |
    */

    'allow_purge' => env('ALLOW_DATA_PURGE', false),

    /*
   |--------------------------------------------------------------------------
   | Allow Backup Deletion
   |--------------------------------------------------------------------------
   |
   | This sets whether or not to allow superadmins to delete backups
   |
   */

    'allow_backup_delete' => env('ALLOW_BACKUP_DELETE', false),

    /*
  |--------------------------------------------------------------------------
  | Escape Excel formulas in CSV exports
  |--------------------------------------------------------------------------
  |
  | This determins whether or not we should escape Excel formulas in CSV exports.
  | This can be UNSAFE in untrusted environments, and therefore defaults to true
  | so that Excel forumals WILL be escaped in CSV exports, however if your workflow
  | is designed around using formulas in your fields, you
  | you can set CSV_ESCAPE_FORMULAS to 'false' in your .env.
  |
  */

    'escape_formulas' => env('CSV_ESCAPE_FORMULAS', true),

    /*
  |--------------------------------------------------------------------------
  | Max Unpaginated Records
  |--------------------------------------------------------------------------
  | This sets the maximum number of records that can be exported or
  | viewed without pagination. This is to prevent server timeouts.
  */

    'max_unpaginated_records' => env('MAX_UNPAGINATED', '5000'),

];
