<?php
/**
 * Ragreen - Global App Configuration
 *
 * Real values (DB credentials, secrets) live in a .env file at the project
 * root (same folder as this /api directory), NOT in this file — .env is
 * environment-specific and should never be committed or shared. See
 * .env.example for the template and README.md for setup + the .htaccess
 * protection that keeps .env from being downloadable over the web.
 */

require_once __DIR__ . '/../includes/env.php';
load_env(__DIR__ . '/../../.env');

// --- Database ---
define('DB_HOST', env('DB_HOST', 'localhost'));
define('DB_NAME', env('DB_NAME', 'ragreen'));
define('DB_USER', env('DB_USER', 'root'));
define('DB_PASS', env('DB_PASS', ''));
define('DB_CHARSET', 'utf8mb4');

// --- App ---
define('APP_ENV', env('APP_ENV', 'local'));     // local | production
define('APP_URL', env('APP_URL', 'http://localhost/ragreen'));
define('SESSION_NAME', 'ragreen_session');

// --- Security ---
define('APP_SECRET', env('APP_SECRET', 'CHANGE_THIS_TO_A_RANDOM_SECRET_STRING'));

// --- Mobile (JWT) auth ---
// Access tokens are short-lived and stateless (never stored server-side).
// Refresh tokens are long-lived and stored (hashed) in auth_refresh_tokens
// so they can be revoked. See includes/jwt.php and api/auth/token*.php.
define('JWT_ACCESS_TTL', 60 * 60);           // 1 hour
define('JWT_REFRESH_TTL', 60 * 60 * 24 * 30); // 30 days

// --- Push notifications (Firebase Cloud Messaging) ---
// Both blank by default = push is a silent no-op everywhere (see
// includes/fcm.php) until an admin sets these up. FCM_SERVICE_ACCOUNT_PATH
// should point OUTSIDE the web root (e.g. one level above public/, same
// as .env itself) - this file is as sensitive as a database password and
// must never be reachable by URL or committed anywhere.
define('FCM_PROJECT_ID', env('FCM_PROJECT_ID', ''));
define('FCM_SERVICE_ACCOUNT_PATH', env('FCM_SERVICE_ACCOUNT_PATH', ''));

// --- Uploads ---
define('UPLOAD_DIR', __DIR__ . '/../../public/assets/uploads/');
// Relative (no leading slash) so it resolves correctly regardless of where
// the app is deployed - domain root or a subfolder like /ragreen/public/.
// Every HTML page lives flat in /public/, so "assets/uploads/..." always
// resolves relative to that same folder no matter which page loaded it.
// An absolute "/assets/uploads/..." would instead resolve from the domain
// root, breaking every image whenever the app isn't deployed at the root -
// exactly what was happening here.
define('UPLOAD_URL', 'assets/uploads/');
define('MAX_UPLOAD_SIZE', 5 * 1024 * 1024); // 5MB

// --- Error display (turn off in production) ---
if (APP_ENV === 'local') {
    ini_set('display_errors', 1);
    error_reporting(E_ALL);
} else {
    ini_set('display_errors', 0);
    error_reporting(0);
}
