<?php
/**
 * App-wide constants. Edit as needed for your deployment.
 */

date_default_timezone_set('Asia/Kolkata');

// Deployment: ai.samirdev.in — admin-panel is deployed at the domain root,
// so uploaded file URLs resolve as http://ai.samirdev.in/uploads/...
define('UPLOAD_DIR', __DIR__ . '/../uploads/');
define('UPLOAD_BASE_URL', '/uploads/'); // adjust only if admin-panel moves to a subfolder

// Admin session token lifetime (seconds) — 7 days
define('ADMIN_SESSION_LIFETIME', 7 * 24 * 60 * 60);

// Brute-force protection: max failed admin logins per email within window
define('ADMIN_MAX_LOGIN_ATTEMPTS', 6);
define('ADMIN_LOGIN_WINDOW_SECONDS', 15 * 60);

// Allowed file types for uploads
define('ALLOWED_IMAGE_TYPES', ['jpg', 'jpeg', 'png', 'webp', 'gif']);
define('ALLOWED_DOC_TYPES', ['jpg', 'jpeg', 'png', 'webp', 'pdf', 'mp4', 'mp3', 'doc', 'docx']);
define('MAX_UPLOAD_SIZE_BYTES', 10 * 1024 * 1024); // 10MB

// CORS: restrict to your app/admin domains in production
define('CORS_ALLOWED_ORIGIN', '*');

// ------------------------------------------------------------------
// DEV MODE OTP - lets registration/login OTP verification pass with a
// fixed code even before SMTP is configured on the "SMTP configuration"
// admin page, so the app can be tested end-to-end without real email
// delivery. The real random OTP is still generated, stored, and emailed
// as normal - this is an ADDITIONAL accepted value, not a replacement.
//
// Set to false once SMTP is live and verified (Send Test Email on the
// admin panel's SMTP page), so real OTPs are the only way in.
// ------------------------------------------------------------------
define('DEV_MODE_OTP_ENABLED', true);
define('DEV_MODE_OTP_CODE', '123456');
