<?php
/**
 * config/database.php
 *
 * HOW TO SECURE CREDENTIALS IN PRODUCTION:
 * 1. Copy config/.env.example → config/.env
 * 2. Fill in real values in config/.env
 * 3. Add config/.env to .gitignore — NEVER commit it
 *
 * This file loads from .env if present; otherwise falls back
 * to the defaults below (safe for local XAMPP development only).
 */

// ── Load .env if it exists ────────────────────────────────────
$envFile = __DIR__ . '/.env';
$env = [];
if (file_exists($envFile)) {
    foreach (file($envFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) as $line) {
        if (str_starts_with(trim($line), '#') || !str_contains($line, '=')) continue;
        [$key, $val] = explode('=', $line, 2);
        $env[trim($key)] = trim($val);
    }
}

return [
    'driver'  => 'mysql',
    'host'    => $env['DB_HOST']    ?? 'localhost',
    'db_name' => $env['DB_NAME']    ?? 'OTIS',
    'user'    => $env['DB_USER']    ?? 'root',
    'pass'    => $env['DB_PASS']    ?? '',
    'charset' => 'utf8mb4',

    // Application Environment: 'local' | 'production'
    'APP_ENV' => $env['APP_ENV'] ?? 'local',

    // Vault AES-256 Encryption Key
    // ⚠ NEVER change this key after initial setup — it will corrupt existing vault entries!
    // Generate a strong key with: php -r "echo bin2hex(random_bytes(32));"
    'VAULT_ENCRYPTION_KEY' => $env['VAULT_ENCRYPTION_KEY'] ?? 'vK9!zXq$5mP#L7tB2@wYcR8^jH4*nF1&',
];
