import type { Config } from './schema';

// Base configuration with default values
// These are overridden by environment-specific configs and process.env
export const baseConfig: Config = {
	server: {
		port: 3001,
		backendUrl: 'http://localhost:3001',
		frontendUrl: 'http://localhost:3000',
		projectName: 'Bekind Backend',
		projectVersion: '1.0.0',
	},
	database: {
		host: 'localhost',
		port: 5432,
		user: 'postgres',
		password: '',
		name: 'sso',
		connectionString: '',
		readHost: '',
		readPort: 5432,
		slowQueryThresholdMs: 500,
		pool: {
			max: 50,
			min: 5,
			acquire: 30000,
			idle: 10000,
			evict: 60000,
		},
	},
	redis: {
		enabled: false,
		host: 'localhost',
		port: 6379,
		password: '',
		db: 0,
		connectTimeout: 10000,
		commandTimeout: 5000,
		maxRetries: 3,
		ipFamily: 4,
	},
	redisA: {
		enabled: false,
		host: 'localhost',
		port: 6379,
		password: '',
		cluster: false,
		clusterNodes: '',
	},
	redisB: {
		host: 'localhost',
		port: 6380,
		password: '',
		db: 0,
	},
	auth: {
		jwtSecret: '', // Must be set via environment
		jwtSecretPrevious: [], // Previous secrets for rotation (comma-separated in env)
		jwtRefreshSecret: '', // Must be set via environment
		jwtRefreshSecretPrevious: [], // Previous refresh secrets for rotation
		jwtExpiresIn: '1h',
		jwtRefreshExpiresIn: '7d',
		tokenEncryptionKey: '', // Must be set via environment (exactly 32 chars)
		tokenEncryptionKeyPrevious: [], // Previous encryption keys for rotation
		bcryptRounds: 12,
		defaultPassword: '', // Must be set via environment
		passwordMinLength: 8,
		passwordMaxLength: 128,
		includeTokensInResponse: false,
		skipSensitiveConfirm: false,
		enableRegister: true,
		passwordHistoryLimit: 5,
	},
	cookie: {
		domain: '.yourdomain.com',
		crossSite: false,
		forceSecure: true,
		devSameSiteLax: false,
		basePath: '',
	},
	uploads: {
		path: './storage/uploads',
		maxFileSize: 10485760,
		imagesPath: '/storage/uploads/images',
		videosPath: '/storage/uploads/videos',
		filesPath: '/storage/uploads/files',
		maxSize: 10485760,
		storageImagesPath: './storage/images',
		compressTimeoutMs: 30000,
	},
	storage: {
		provider: 'minio',
		publicBaseUrl: 'http://localhost:3001',
		localStorageRoot: './storage/uploads',
		minio: {
			endpoint: 'minio',
			port: 9000,
			useSSL: true,
			accessKey: '', // Must be set via environment
			secretKey: '', // Must be set via environment
			bucket: 'uploads',
			region: 'us-east-1',
			s3Bucket: '',
		},
		quotaPerUser: 0,
	},
	email: {
		host: 'smtp.example.com',
		port: 587,
		user: '',
		pass: '', // Must be set via environment
		from: 'noreply@yourdomain.com',
	},
	notifications: {
		rateLimiting: {
			maxLoginAttempts: 5,
			lockoutDurationMinutes: 15,
			rateLimitWindowMs: 60000,
			rateLimitOnesignalMax: 100,
			rateLimitZaloMax: 50,
			rateLimitEmailMax: 200,
		},
		maxRetries: 3,
	},
	csrf: {
		originValidation: true,
		doubleSubmit: true,
		httpOnly: true,
		devSameSiteLax: false,
		allowedOrigins: [],
	},
	zalo: {
		appId: '',
		secretKey: '',
		oaAccessToken: '',
		znsAccessToken: '',
		znsTemplateId: '',
		serviceJwtSecret: '',
		mtlsEnabled: false,
		workloadIdentityEnabled: false,
	},
	oneSignal: {
		appId: '',
		apiKey: '',
	},
	vapid: {
		subject: 'mailto:admin@yourdomain.com',
		publicKey: '',
		privateKey: '',
	},
	idempotency: {
		keyTtl: 86400, // 24 hours
	},
	circuitBreaker: {
		errorRate: 0.3,
		minRequests: 100,
		timeout: 300000, // 5 minutes
	},
	partition: {
		retainMonths: 12,
	},
	virusScan: {
		enabled: false,
		clamSocket: '',
		clamHost: '127.0.0.1',
		clamPort: 3310,
		clamScanTimeoutMs: 15000,
		failOpen: false,
	},
	logging: {},
	cors: {
		devDisable: false,
	},
	featureFlags: {
		enableRedis: false,
		enableVirusScan: true,
		enableCSRF: true,
		enableRateLimit: true,
		showStackInErrors: false,
		fileListUrlConcurrency: 5,
		maxSimpleFallbackSize: 5000,
		maxFallbackMapSize: 10000,
	},
	audit: {
		mode: 'direct',
		enabled: true,
	},
	runtime: {
		logLevel: 'info',
		batchSize: 100,
		pollInterval: 500,
	},
	webhook: {
		token: '',
	},
	emailVerification: {
		tokenTtlHours: 24,
	},
};
