<?php

declare(strict_types=1);

return [

    /*
    |--------------------------------------------------------------------------
    | Audit Logging
    |--------------------------------------------------------------------------
    |
    | Enable or disable audit logging across the application.
    |
    */

    'enabled' => env('AUDIT_LOGGING_ENABLED', true),

    /*
    |--------------------------------------------------------------------------
    | Data Retention
    |--------------------------------------------------------------------------
    |
    | Configure how long audit logs should be retained before being archived
    | or deleted. This setting is used by compliance checks to verify that
    | automated data retention is configured.
    |
    */

    'retention_days' => env('AUDIT_LOG_RETENTION_DAYS', 365),

    /*
    |--------------------------------------------------------------------------
    | Auto Purge
    |--------------------------------------------------------------------------
    |
    | When enabled, audit logs older than the retention period will be
    | automatically purged by the scheduled cleanup job.
    |
    */

    'auto_purge' => env('AUDIT_AUTO_PURGE', false),

    /*
    |--------------------------------------------------------------------------
    | Archive Strategy
    |--------------------------------------------------------------------------
    |
    | Defines what happens to audit logs after the retention period.
    | Options: 'delete', 'archive_cold', 'archive_s3'
    |
    */

    'archive_strategy' => env('AUDIT_ARCHIVE_STRATEGY', 'archive_cold'),

    /*
    |--------------------------------------------------------------------------
    | Sensitive Fields
    |--------------------------------------------------------------------------
    |
    | Fields that should be redacted when stored in audit logs.
    |
    */

    'sensitive_fields' => [
        'password',
        'password_confirmation',
        'secret',
        'token',
        'api_key',
        'credit_card',
        'ssn',
        'social_security',
        'bank_account',
        'private_key',
        'two_factor_secret',
        'two_factor_recovery_codes',
    ],

];