<?php
declare(strict_types=1);

// Copy to /etc/self-service-now/member_email.php on DigitalOcean.
// Keep the real file outside the web root and source control.
return [
    'enabled' => true,
    'code_expiry_seconds' => 600,
    'code_max_attempts' => 5,
    'resend_seconds' => 60,
    'max_email_hour' => 5,
    'max_member_hour' => 10,
    'max_installation_hour' => 10,
    'max_ip_hour' => 30,

    // Generate two different values on the server with:
    // openssl rand -hex 32
    'code_hmac_key' => 'REPLACE_WITH_A_RANDOM_SECRET_OF_AT_LEAST_32_CHARACTERS',
    'ip_hmac_key' => 'REPLACE_WITH_A_DIFFERENT_RANDOM_SECRET_OF_AT_LEAST_32_CHARACTERS',

    'relay' => [
        'endpoint' => 'https://self-service.sg/api/member-email-relay.php',
        // Generate a third independent value. It must match the protected
        // AwardSpace relay configuration and must never be placed in a URL.
        'bearer_token' => 'REPLACE_WITH_A_THIRD_RANDOM_SECRET_OF_AT_LEAST_32_CHARACTERS',
    ],
];