<?php

declare(strict_types=1);

return [
    'https' => [
        'force' => filter_var(env('FORCE_HTTPS', false), FILTER_VALIDATE_BOOL),
    ],
    'headers' => [
        'enabled' => filter_var(env('SECURITY_HEADERS_ENABLED', true), FILTER_VALIDATE_BOOL),
        'x_frame_options' => (string) env('SECURITY_X_FRAME_OPTIONS', 'SAMEORIGIN'),
        'x_content_type_options' => (string) env('SECURITY_X_CONTENT_TYPE_OPTIONS', 'nosniff'),
        'referrer_policy' => (string) env('SECURITY_REFERRER_POLICY', 'strict-origin-when-cross-origin'),
        'permissions_policy' => (string) env(
            'SECURITY_PERMISSIONS_POLICY',
            'geolocation=(), microphone=(), camera=()'
        ),
        'x_permitted_cross_domain_policies' => (string) env('SECURITY_X_PERMITTED_CROSS_DOMAIN_POLICIES', 'none'),
        'cross_origin_opener_policy' => (string) env('SECURITY_CROSS_ORIGIN_OPENER_POLICY', 'same-origin-allow-popups'),
        'cross_origin_resource_policy' => (string) env('SECURITY_CROSS_ORIGIN_RESOURCE_POLICY', 'same-site'),
        'hsts_enabled' => filter_var(env('HSTS_ENABLED', false), FILTER_VALIDATE_BOOL),
        'hsts_max_age' => max(0, (int) env('HSTS_MAX_AGE', 31536000)),
        'hsts_include_subdomains' => filter_var(env('HSTS_INCLUDE_SUBDOMAINS', true), FILTER_VALIDATE_BOOL),
        'hsts_preload' => filter_var(env('HSTS_PRELOAD', false), FILTER_VALIDATE_BOOL),
    ],
    'session' => [
        'cookie_secure' => filter_var(env('SESSION_SECURE_COOKIE', false), FILTER_VALIDATE_BOOL),
        'cookie_httponly' => filter_var(env('SESSION_HTTP_ONLY', true), FILTER_VALIDATE_BOOL),
        'cookie_samesite' => (string) env('SESSION_SAME_SITE', 'Lax'),
    ],
];

