<?php

declare(strict_types=1);

return [
    // Header names required for every authenticated request
    'headers' => [
        'user_id' => 'HTTP_X_USER_ID',
        'fingerprint' => 'HTTP_X_DEVICE_FINGERPRINT',
        'timestamp' => 'HTTP_X_TIMESTAMP',
        'nonce' => 'HTTP_X_NONCE',
        'signature' => 'HTTP_X_SIGNATURE',
    ],
    // Time tolerance in seconds for anti-replay check
    'timestamp_tolerance' => 120, // 2 minutes
    // Dynamic QR token lifetime in seconds
    'qr_token_lifetime' => 90, // 90 seconds rotation
    // Encryption cipher
    'cipher' => 'aes-256-gcm',
    // Password hash algorithm
    'password_algo' => defined('PASSWORD_ARGON2ID') ? PASSWORD_ARGON2ID : PASSWORD_BCRYPT,
];