<?php

/**
 * License + Envato verification config.
 *
 * Holds the seller's Envato Personal Access Token in an
 * AES-256-GCM-encrypted form so the codebase can be shipped to every
 * customer without leaking the raw token. Decryption happens at
 * runtime via App\Services\License\TokenVault, which uses an internal
 * key derived from a hardcoded constant — NOT Laravel's APP_KEY
 * (APP_KEY differs per install, so encrypting with it would make the
 * ciphertext unreadable on the customer's server).
 *
 * If you ever need to regenerate the ciphertext (e.g. you rotated the
 * Envato PAT), run this one-liner from the project root:
 *
 *   php -r "
 *       \$token = 'YOUR_NEW_ENVATO_PAT';
 *       \$key   = hash('sha256', 'mailtrixy::license::vault::v1::do-not-change', true);
 *       \$iv    = random_bytes(12);
 *       \$tag   = '';
 *       \$ct    = openssl_encrypt(\$token, 'aes-256-gcm', \$key, OPENSSL_RAW_DATA, \$iv, \$tag);
 *       echo base64_encode(\$iv . \$tag . \$ct) . PHP_EOL;
 *   "
 *
 * Then paste the output into envato_token_ciphertext below.
 */

return [

    /*
    |--------------------------------------------------------------------------
    | Envato Personal Access Token (encrypted)
    |--------------------------------------------------------------------------
    | The seller's PAT used to call api.envato.com/v3/market/author/sale.
    | Customer purchase codes are verified against this — the token has
    | read-only "view items the user has bought" scope on Envato, so even
    | if a determined attacker extracts it, they can only query sales
    | data (no destructive actions possible).
    |
    | Format: base64( 12-byte IV || 16-byte GCM tag || ciphertext )
    */
    'envato_token_ciphertext' => env(
        'ENVATO_TOKEN_CIPHERTEXT',
        'SEAkUZkJ6RLH96N+nezzKWUi2+MeHjaSK+uM8UsQGApt1vEk+G0X6YnV/1dLyKh7AVPmNd5CTtX69FyI'
    ),

    /*
    |--------------------------------------------------------------------------
    | Envato product id for the main MailTrixy app
    |--------------------------------------------------------------------------
    | Returned by api.envato.com as `item.id`. A purchase code is only
    | accepted when the sale's item.id matches this value — protects
    | against customers buying a totally different product on Envato
    | and trying to use that code to install MailTrixy.
    */
    'product_id' => env('LICENSE_PRODUCT_ID', '62602989'),

    /*
    |--------------------------------------------------------------------------
    | Envato API endpoint
    |--------------------------------------------------------------------------
    */
    'envato_api_url' => 'https://api.envato.com/v3/market/author/sale',

    /*
    |--------------------------------------------------------------------------
    | Storage location for license files
    |--------------------------------------------------------------------------
    | Files live under storage/app/{licenses_subdirectory}/. One JSON
    | file per license, named by type and slug (e.g. main_app.json,
    | addon_whatsapp.json).
    */
    'licenses_subdirectory' => 'licenses',

];
