<?php
declare(strict_types=1);

// Copy this example to /etc/self-service-now/member_auth.php on the server.
// Keep the real file and every value below outside the web root and source control.
return [
    'enabled' => false,

    'otp_expiry_seconds' => 300,
    'otp_max_attempts' => 5,
    'resend_seconds' => 60,
    'max_phone_hour' => 5,
    'max_phone_day' => 10,
    'max_installation_hour' => 10,
    'max_ip_hour' => 30,
    'session_days' => 180,

    // Generate two different high-entropy values directly on the server.
    'otp_hmac_key' => 'REPLACE_WITH_A_RANDOM_SECRET_OF_AT_LEAST_32_CHARACTERS',
    'ip_hmac_key' => 'REPLACE_WITH_A_DIFFERENT_RANDOM_SECRET_OF_AT_LEAST_32_CHARACTERS',

    'sms' => [
        // Use the SMS provider's HTTPS API endpoint.
        'endpoint' => 'https://sms-provider.example/v1/messages',
        'recipient_field' => 'to',
        'message_field' => 'message',
        'success_prefix' => 'OK:',

        // Put provider-specific account fields and credentials only in the
        // protected copy under /etc/self-service-now/member_auth.php.
        'static_fields' => [
            'api_key' => 'REPLACE_IN_THE_PROTECTED_SERVER_COPY',
        ],

        // Use this for providers that require an Authorization header instead.
        'headers' => [],
    ],
];