APP_NAME="BIPL Takaful Portal"
APP_ENV=local
APP_KEY=base64:xcCiCgCC1KbJWqyS1MBJLaGrS2jAbV4xXfa96xACifI=
APP_DEBUG=false
APP_TIMEZONE=Asia/Karachi
APP_URL=https://ff47ee803ff57d.lhr.life

APP_LOCALE=en
APP_FALLBACK_LOCALE=en
APP_FAKER_LOCALE=en_US

APP_MAINTENANCE_DRIVER=file
# APP_MAINTENANCE_STORE=database

# PHP_CLI_SERVER_WORKERS=4

BCRYPT_ROUNDS=12

LOG_CHANNEL=stack
LOG_STACK=daily
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=bipl_takaful
DB_USERNAME=root
DB_PASSWORD=

SESSION_DRIVER=database
SESSION_LIFETIME=120
SESSION_ENCRYPT=false
SESSION_PATH=/
SESSION_DOMAIN=null

BROADCAST_CONNECTION=log
FILESYSTEM_DISK=local
QUEUE_CONNECTION=database

CACHE_STORE=database
# CACHE_PREFIX=

MEMCACHED_HOST=127.0.0.1

REDIS_CLIENT=phpredis
REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379

MAIL_MAILER=log
MAIL_SCHEME=null
MAIL_HOST=127.0.0.1
MAIL_PORT=2525
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_FROM_ADDRESS="noreply@efulife.com"
MAIL_FROM_NAME="${APP_NAME}"

AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=
AWS_USE_PATH_STYLE_ENDPOINT=false

VITE_APP_NAME="${APP_NAME}"

# ----------------------------------------------------------------------------
# React journey (customer facing SPA)
# ----------------------------------------------------------------------------
JOURNEY_URL=https://ff47ee803ff57d.lhr.life/journey
SANCTUM_STATEFUL_DOMAINS=localhost,localhost:3000,127.0.0.1,127.0.0.1:3000
FRONTEND_ORIGINS="http://localhost:3000,http://127.0.0.1:3000,https://ff47ee803ff57d.lhr.life"

# ----------------------------------------------------------------------------
# BankIslami (BIPL) hand-off payload encryption
# The bank encrypts the customer payload and appends it to the journey URL:
#   https://bipl.efulife.com/?data=<urlencoded-ciphertext>
# ----------------------------------------------------------------------------
# rsa: we publish a public key, BIPL encrypt with it, we decrypt with the
# private key. Generate the pair with: php artisan bipl:keypair
BIPL_CRYPTO_STRATEGY=rsa
BIPL_RSA_PADDING=oaep
# Defaults to storage/keys/*.pem; set these only to override.
# BIPL_RSA_PRIVATE_KEY=
# BIPL_RSA_PUBLIC_KEY=
# BIPL_RSA_PASSPHRASE=

# base64 | hex  -- how the ciphertext is transported in the query string
BIPL_PAYLOAD_ENCODING=base64

# blob   -> ?data=<one encrypted value carrying every field>
# fields -> ?msisdn=<enc>&cnic=<enc>&name=<enc>&email=<enc>
# auto   -> blob when a `data` parameter is present, otherwise fields
BIPL_PAYLOAD_MODE=auto
BIPL_BLOB_PARAMETER=data
# Comma-separated parameters BIPL send in the clear (not decrypted).
BIPL_PLAINTEXT_FIELDS=

# Symmetric fallback, only used when BIPL_CRYPTO_STRATEGY=aes
BIPL_CIPHER=AES-256-CBC
BIPL_CRYPTO_KEY=0123456789abcdef0123456789abcdef
BIPL_CRYPTO_IV=abcdef9876543210
BIPL_RANDOM_IV=false
# Optional HMAC-SHA256 signature check on the ciphertext (?sig=)
BIPL_SIGNATURE_ENABLED=false
BIPL_SIGNATURE_SECRET=
# Reject payloads older than N seconds (0 = disabled). Requires a `ts` field.
BIPL_PAYLOAD_TTL=900
# Allow the same ciphertext to be resolved more than once
BIPL_ALLOW_REPLAY=true

# ----------------------------------------------------------------------------
# Customer journey session tokens (issued by /api/v1/entry/resolve)
# ----------------------------------------------------------------------------
CUSTOMER_SESSION_TTL=3600

# ----------------------------------------------------------------------------
# Business rules
# ----------------------------------------------------------------------------
TAKAFUL_ENROLLMENT_AGE_MIN=18
TAKAFUL_ENROLLMENT_AGE_MAX=64
TAKAFUL_COVERAGE_AGE_MAX=65
TAKAFUL_FREE_LOOK_DAYS=15
TAKAFUL_POLICY_PREFIX=BIPL

# ----------------------------------------------------------------------------
# OTP (consent verification)
# ----------------------------------------------------------------------------
OTP_ENABLED=true
OTP_LENGTH=6
OTP_TTL=300
OTP_MAX_ATTEMPTS=3
OTP_TEST_MODE=true
OTP_TEST_CODE=123456

# Time the scheduler generates the daily lead extract
LEAD_EXPORT_CUTOFF=23:00

# ----------------------------------------------------------------------------
# Temporary public tunnel (see docs/deployment.md). Unset for local-only work.
# ----------------------------------------------------------------------------
TRUSTED_PROXIES=*
