<?php

return [
    /*
    |--------------------------------------------------------------------------
    | API Security Configuration
    |--------------------------------------------------------------------------
    |
    | This configuration controls API security settings for production
    | environments, including blocking API testing tools.
    |
    */

    /*
    |--------------------------------------------------------------------------
    | Block API Tools in Production
    |--------------------------------------------------------------------------
    |
    | When enabled, this will block common API testing tools like Postman,
    | Insomnia, curl, etc. from accessing the API in production environment.
    |
    */

    'block_api_tools_in_production' => env('BLOCK_API_TOOLS_IN_PRODUCTION', true),

    /*
    |--------------------------------------------------------------------------
    | Enable API Key Authentication
    |--------------------------------------------------------------------------
    |
    | When enabled, external systems can use API keys to bypass API tool
    | blocking and access protected endpoints.
    |
    */

    'enable_api_key_auth' => env('ENABLE_API_KEY_AUTH', true),

    /*
    |--------------------------------------------------------------------------
    | Blocked User Agents
    |--------------------------------------------------------------------------
    |
    | List of User-Agent strings that should be blocked in production.
    | These are common API testing tools and clients.
    |
    */

    'blocked_user_agents' => [
        'insomnia',
        'postman',
        'postmanruntime',
        'curl',
        'wget',
        'httpie',
        'restclient',
        'apifox',
        'thunder client',
        'rapidapi',
        'swagger',
        'openapi',
        'api tester',
        'api client',
        'rest client',
        'http client',
        'api explorer',
        'api documentation',
        'soapui',
        'jmeter',
        'newman',
        'paw',
        'charles',
        'fiddler',
        'burp',
        'zap',
        'mitmproxy',
    ],

    /*
    |--------------------------------------------------------------------------
    | Minimum User-Agent Length
    |--------------------------------------------------------------------------
    |
    | Minimum length for User-Agent strings. Shorter strings are considered
    | suspicious and will be blocked.
    |
    */

    'min_user_agent_length' => env('MIN_USER_AGENT_LENGTH', 10),

    /*
    |--------------------------------------------------------------------------
    | Custom Error Message
    |--------------------------------------------------------------------------
    |
    | Custom error message to display when API tools are blocked.
    |
    */

    'blocked_message' => env('API_BLOCKED_MESSAGE', 'API access is restricted in production environment. Please use the web interface.'),

    /*
    |--------------------------------------------------------------------------
    | Allowed IP Addresses
    |--------------------------------------------------------------------------
    |
    | List of IP addresses that are allowed to bypass API tool blocking.
    | Useful for monitoring tools or legitimate API clients.
    |
    */

    'allowed_ips' => array_filter(explode(',', env('API_ALLOWED_IPS', ''))),

    /*
    |--------------------------------------------------------------------------
    | Allowed User Agents
    |--------------------------------------------------------------------------
    |
    | List of User-Agent patterns that are allowed even if they match
    | blocked patterns. Useful for legitimate monitoring tools.
    |
    */

    'allowed_user_agents' => array_filter(explode(',', env('API_ALLOWED_USER_AGENTS', ''))),

    /*
    |--------------------------------------------------------------------------
    | Valid API Keys
    |--------------------------------------------------------------------------
    |
    | List of valid API keys for external system access. These keys allow
    | external systems to bypass API tool blocking when making requests.
    | 
    | Format: Comma-separated list of API keys
    | Example: API_VALID_KEYS=key1,key2,key3
    |
    */

    'valid_api_keys' => array_filter(explode(',', env('API_VALID_KEYS', ''))),

    /*
    |--------------------------------------------------------------------------
    | API Key Header Names
    |--------------------------------------------------------------------------
    |
    | List of header names that can contain API keys. The middleware will
    | check these headers for valid API keys.
    |
    */

    'api_key_headers' => [
        'X-API-Key',
        'API-Key',
        'Authorization', // Bearer token format
    ],

    /*
    |--------------------------------------------------------------------------
    | API Key Logging
    |--------------------------------------------------------------------------
    |
    | Whether to log API key usage for monitoring and security purposes.
    | When enabled, logs will include API key usage (without exposing the key).
    |
    */

    'log_api_key_usage' => env('API_LOG_KEY_USAGE', true),
];