<?php

return [
    'enabled' => (bool) env('DINGTALK_LOGIN_ENABLED', false),

    'client_id' => env('DINGTALK_CLIENT_ID'),
    'client_secret' => env('DINGTALK_CLIENT_SECRET'),
    'redirect_uri' => env(
        'DINGTALK_REDIRECT_URI',
        rtrim(env('APP_URL', 'https://caiwu.jiansuntuzhi.cn:8442'), '/').'/auth/dingtalk/callback'
    ),

    // Verified HR roots: 简尚财务中心 and 龙晨品牌中心/财务中心.
    'finance_department_ids' => array_values(array_filter(array_map('trim', explode(',', env('DINGTALK_FINANCE_DEPARTMENT_IDS', '22848291,994080505'))))),
    // When omitted, automatic provisioning requires exactly one enabled company.
    'company_id' => env('DINGTALK_COMPANY_ID'),

    // Explicitly approved enterprise user IDs only; never names or departments.
    // Applies the highest role on first provisioning, not on subsequent logins.
    'super_admin_user_ids' => array_values(array_filter(array_map('trim', explode(',', env('DINGTALK_SUPER_ADMIN_USER_IDS', ''))))),

    'authorize_url' => env('DINGTALK_AUTHORIZE_URL', 'https://login.dingtalk.com/oauth2/auth'),
    'token_url' => env('DINGTALK_TOKEN_URL', 'https://api.dingtalk.com/v1.0/oauth2/userAccessToken'),
    'user_url' => env('DINGTALK_USER_URL', 'https://api.dingtalk.com/v1.0/contact/users/me'),
    'app_token_url' => env('DINGTALK_APP_TOKEN_URL', 'https://oapi.dingtalk.com/gettoken'),
    'user_by_union_id_url' => env('DINGTALK_USER_BY_UNION_ID_URL', 'https://oapi.dingtalk.com/topapi/user/getbyunionid'),
    'user_detail_url' => env('DINGTALK_USER_DETAIL_URL', 'https://oapi.dingtalk.com/topapi/v2/user/get'),

    'timeout' => (int) env('DINGTALK_HTTP_TIMEOUT', 10),
    'state_ttl_minutes' => (int) env('DINGTALK_STATE_TTL_MINUTES', 5),
];