<?php

declare(strict_types=1);

/**
 * ACC Standalone API Configuration — hardened
 */

require_once __DIR__ . '/security.php';

// Optional local overrides: return ['host'=>'...','name'=>'...','user'=>'...','pass'=>'...','prefix'=>'wp_'];
$db_local = [];
$db_local_file = __DIR__ . '/db.local.php';
if ( is_file( $db_local_file ) ) {
	$loaded = include $db_local_file;
	if ( is_array( $loaded ) ) {
		$db_local = $loaded;
	}
}

// Load secrets (generated file or env). Never fall back to public placeholders in production.
$secrets_local = __DIR__ . '/secrets.local.php';
if ( is_file( $secrets_local ) ) {
	require_once $secrets_local;
} elseif ( is_file( __DIR__ . '/secrets.example.php' ) && acc_is_local_environment() ) {
	require_once __DIR__ . '/secrets.example.php';
}

define( 'ACC_DEBUG', getenv( 'ACC_DEBUG' ) === '1' && acc_is_local_environment() );

date_default_timezone_set( 'Asia/Tehran' );

define( 'ACC_DB_HOST', (string) ( $db_local['host'] ?? ( getenv( 'ACC_DB_HOST' ) ?: 'localhost' ) ) );
define( 'ACC_DB_NAME', (string) ( $db_local['name'] ?? ( getenv( 'ACC_DB_NAME' ) ?: 'sademlis_ostad51' ) ) );
define( 'ACC_DB_USER', (string) ( $db_local['user'] ?? ( getenv( 'ACC_DB_USER' ) ?: 'root' ) ) );
define( 'ACC_DB_PASS', (string) ( $db_local['pass'] ?? ( getenv( 'ACC_DB_PASS' ) ?: '' ) ) );
define( 'ACC_DB_CHARSET', 'utf8mb4' );
define( 'ACC_DB_PREFIX', (string) ( $db_local['prefix'] ?? ( getenv( 'ACC_DB_PREFIX' ) ?: 'wp_' ) ) );

define(
	'ACC_DB_DSN',
	'mysql:host=' . ACC_DB_HOST . ';dbname=' . ACC_DB_NAME . ';charset=' . ACC_DB_CHARSET
);

define( 'ACC_API_BASE', '/acc-engine/api.php' );

// Auth: mock only if local AND explicitly enabled
$auth_env = getenv( 'ACC_AUTH_MODE' );
if ( $auth_env === false || $auth_env === '' ) {
	$want_mock = acc_is_local_environment() && getenv( 'ACC_ENABLE_MOCK_AUTH' ) === '1';
	define( 'ACC_AUTH_MODE', $want_mock ? 'mock' : 'jwt' );
} else {
	$mode = strtolower( trim( (string) $auth_env ) );
	if ( $mode === 'mock' && ( ! acc_is_local_environment() || getenv( 'ACC_ENABLE_MOCK_AUTH' ) !== '1' ) ) {
		$mode = 'jwt';
	}
	define( 'ACC_AUTH_MODE', $mode );
}

define( 'ACC_MOCK_USER_ID', (int) ( getenv( 'ACC_MOCK_USER_ID' ) ?: 1 ) );

if ( ! defined( 'ACC_JWT_SECRET' ) ) {
	$jwt = getenv( 'ACC_JWT_SECRET' ) ?: '';
	if ( $jwt === '' || $jwt === 'CHANGE_THIS_SECRET_KEY' || strlen( $jwt ) < 32 ) {
		if ( ! acc_is_local_environment() ) {
			http_response_code( 503 );
			header( 'Content-Type: application/json; charset=utf-8' );
			echo json_encode( [ 'success' => false, 'message' => 'Server misconfigured: ACC_JWT_SECRET required' ], JSON_UNESCAPED_UNICODE );
			exit;
		}
		$jwt = hash( 'sha256', __DIR__ . php_uname() . 'acc-local-dev' );
	}
	define( 'ACC_JWT_SECRET', $jwt );
}
define( 'ACC_JWT_ALG', 'HS256' );

if ( ! defined( 'C3P_CAPITAL_API_KEY' ) ) {
	define( 'C3P_CAPITAL_API_KEY', getenv( 'C3P_CAPITAL_API_KEY' ) ?: 'c3p-unset' );
}
if ( ! defined( 'ACC_APP_KEY' ) ) {
	define( 'ACC_APP_KEY', getenv( 'ACC_APP_KEY' ) ?: hash( 'sha256', ACC_JWT_SECRET . '|app' ) );
}

define( 'ACC_JSON_FLAGS', JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES );
define( 'ACC_LOAD_ALL_CONTROLLERS', ( getenv( 'ACC_LOAD_ALL_CONTROLLERS' ) ?: '0' ) === '1' );
define( 'ACC_SECURITY_LEVEL', acc_is_local_environment() ? 'local' : 'production' );
define( 'ACC_ENABLE_DEMO_OTP', getenv( 'ACC_ENABLE_DEMO_OTP' ) === '1' && acc_is_local_environment() );
define( 'ACC_ENABLE_DEMO_ENDPOINTS', getenv( 'ACC_ENABLE_DEMO_ENDPOINTS' ) === '1' && acc_is_local_environment() );
