<?php

declare(strict_types=1);

use App\Core\Env;

return [
    // 'database' stores sessions in MySQL (survives app restarts, works
    // across multiple app servers behind a load balancer). 'files' uses
    // storage/sessions and is fine for a single-server deployment.
    'driver' => Env::get('SESSION_DRIVER', 'database'),

    'lifetime_minutes' => (int) Env::get('SESSION_LIFETIME_MINUTES', 120),

    'cookie' => [
        'name'      => Env::get('SESSION_COOKIE_NAME', 'ab_hub_session'),
        'path'      => '/',
        'domain'    => '',
        // secure=true requires HTTPS. Only disable for local http:// dev.
        'secure'    => (bool) Env::get('SESSION_SECURE_COOKIE', true),
        'httponly'  => true,
        // Lax is the right default for a same-site admin app; use
        // 'Strict' if the app never needs to be entered via an external
        // link (e.g. an email "view invoice" link would break under Strict).
        'samesite'  => Env::get('SESSION_SAMESITE', 'Lax'),
    ],

    'files_path' => dirname(__DIR__) . '/storage/sessions',
];
