import type { Config } from './schema';
import { baseConfig } from './base';

// Production-specific configuration overrides
// Strict security settings for production
export const productionConfig: Partial<Config> = {
	server: {
		...baseConfig.server,
		port: 3001,
		backendUrl: 'https://api.sso.vietprodev.com',
		frontendUrl: 'https://app.vietprodev.com,https://admin.vietprodev.com',
	},
	database: {
		...baseConfig.database,
		host: 'pgbouncer',
		port: 5432,
		connectionString: '',
		readHost: 'haproxy',
		readPort: 5433,
	},
	redis: {
		...baseConfig.redis,
		enabled: true,
		host: 'redis', // Typically a service name in container orchestration
	},
	redisA: {
		...baseConfig.redisA,
		enabled: true,
	},
	auth: {
		...baseConfig.auth,
		bcryptRounds: 12, // Strong hashing for production
		includeTokensInResponse: false, // Security best practice
		skipSensitiveConfirm: false, // Require confirmation for sensitive operations
	},
	cookie: {
		...baseConfig.cookie,
		domain: '.vietprodev.com',
		forceSecure: true, // HTTPS only in production
		devSameSiteLax: false, // Strict same-site policy
	},
	uploads: {
		...baseConfig.uploads,
		maxFileSize: 10485760, // 10MB
	},
	storage: {
		...baseConfig.storage,
		provider: 'minio', // Use MinIO/S3 in production
		publicBaseUrl: 'https://cdn.vietprodev.com',
		minio: {
			...baseConfig.storage.minio,
			endpoint: 'minio.vietprodev.com',
			port: 9000,
			useSSL: true, // HTTPS required
			bucket: 'sso',
		},
	},
	notifications: {
		rateLimiting: {
			maxLoginAttempts: 5, // Strict rate limiting
			lockoutDurationMinutes: 15, // 15-minute lockout
			rateLimitWindowMs: 60000,
			rateLimitOnesignalMax: 100,
			rateLimitZaloMax: 50,
			rateLimitEmailMax: 200,
		},
		maxRetries: 3,
	},
	csrf: {
		originValidation: true, // Enable CSRF protection
		doubleSubmit: true, // Enable double-submit cookie pattern
		httpOnly: true, // HTTP-only cookies
		devSameSiteLax: false,
		allowedOrigins: [],
	},
	virusScan: {
		enabled: true, // Enable virus scan in production
		clamSocket: '/var/run/clamav/clamd.ctl', // Unix socket for ClamAV
	},
	logging: {
		level: 'warn', // Less verbose in production
	},
	cors: {
		devDisable: false, // Enable CORS restrictions in production
	},
	featureFlags: {
		enableRedis: true,
		enableVirusScan: true,
		enableCSRF: true,
		enableRateLimit: true, // Enable rate limiting in production
		showStackInErrors: false,
		fileListUrlConcurrency: 5,
		maxSimpleFallbackSize: 5000,
		maxFallbackMapSize: 10000,
	},
};
