<?php
declare(strict_types=1);

return [
    'cors' => [
        'allowed_origins' => array_filter(explode(',', env('CORS_ORIGINS', 'http://localhost:3000,http://localhost:5173'))),
        'allowed_methods' => ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
        'allowed_headers' => ['Content-Type', 'Authorization', 'X-Requested-With', 'Accept'],
        'exposed_headers' => ['X-Request-Id'],
        'max_age' => 86400,
        'allow_credentials' => true,
    ],

    'token' => [
        'ttl_hours' => (int) env('API_TOKEN_TTL_HOURS', 720),
        'max_per_employee' => 5,
    ],

    'rate_limit' => [
        'requests_per_minute' => (int) env('API_RATE_LIMIT', 60),
    ],
];
