<?php

use App\Support\Authorization\PermissionCatalog;

return [
    /*
    |--------------------------------------------------------------------------
    | Authenticated self-service routes
    |--------------------------------------------------------------------------
    |
    | These routes are intentionally available to every authenticated user.
    | Listing them here makes that decision explicit instead of relying on an
    | accidental absence of permission middleware.
    |
    */
    'self_service_routes' => [
        'logout' => 'Every authenticated user must be able to end their own session.',
        'security.show' => 'Every authenticated user may review their own security settings.',
        'security.two-factor.enable' => 'A user may enable two-factor authentication on their own account.',
        'security.two-factor.confirm' => 'A user may confirm two-factor authentication on their own account.',
        'security.two-factor.disable' => 'A user may disable two-factor authentication on their own account after the security flow validates the request.',
        'security.two-factor.recovery-codes' => 'A user may regenerate recovery codes for their own account after the security flow validates the request.',
        'notification-center.index' => 'Every authenticated user may review their own personal notifications; privileged alert and delivery-failure sections remain permission-gated in the controller.',
        'notification-center.read-all' => 'Every authenticated user may mark only their own unread personal notifications as read.',
        'notification-center.read' => 'Every authenticated user may mark only a notification owned by their account as read.',
        'notification-center.open' => 'Every authenticated user may open only a notification owned by their account; destination links remain permission-gated.',
        'notification-center.destroy' => 'Every authenticated user may delete only a notification owned by their account.',
    ],

    /*
    |--------------------------------------------------------------------------
    | Authenticated transitional/support exemptions
    |--------------------------------------------------------------------------
    |
    | Dashboard and global search were converted to explicit Phase 8
    | permissions. Document branding remains an authenticated support asset,
    | with business/branch authorization enforced by its controller.
    |
    */
    'authenticated_exemptions' => [
        'document-branding.asset' => 'Authenticated document-rendering support asset; controller authorization requires access to a branch owned by the requested business.',
    ],

    /*
    |--------------------------------------------------------------------------
    | Public/authentication-flow routes
    |--------------------------------------------------------------------------
    |
    | Named application routes without auth middleware must be declared here.
    | Framework-owned unnamed routes such as the health endpoint are ignored by
    | the strict application-route classifier.
    |
    */
    'public_routes' => [
        'home' => 'Public root redirect to the authenticated dashboard/login flow.',
        'login' => 'Guest authentication form.',
        'login.store' => 'Guest authentication submission protected by throttling.',
        'password.request' => 'Guest password-reset request form.',
        'password.email' => 'Guest password-reset email submission protected by throttling.',
        'password.reset' => 'Guest password-reset form with reset token.',
        'password.update' => 'Guest password-reset submission protected by throttling.',
        'two-factor.challenge' => 'Authentication-flow two-factor challenge form.',
        'two-factor.challenge.store' => 'Authentication-flow two-factor challenge submission protected by throttling.',
        'locale.switch' => 'Public session preference endpoint so a user can choose an active language before authentication; the controller accepts only enabled language codes.',
        'remote-payments.public.create' => 'Module-gated public remote-payment evidence submission form.',
        'remote-payments.public.store' => 'Module-gated and throttled public remote-payment evidence submission.',
    ],

    /*
    |--------------------------------------------------------------------------
    | Legacy/broad permissions
    |--------------------------------------------------------------------------
    |
    | The canonical permission catalog owns this registry. Keeping the value in
    | config preserves the Phase 0 report contract without duplicating names,
    | reasons, or replacement mappings here.
    |
    */
    'legacy_broad_permissions' => PermissionCatalog::legacyPermissions(),

    'source_scan_paths' => [
        'app',
        'routes',
        'resources/views',
        'database/seeders',
    ],
];
