<?php

/**
 * SAML SP settings and IdP placeholders.
 * IdP values are replaced at runtime in SamlController::getSamlAuth() from `saml_client`.
 */
$app = config('App');
$base = rtrim((string) base_url(), '/');

$certDir = APPPATH . 'Libraries/Saml/certs/';
$spCert   = is_file($certDir . 'sp.crt') ? file_get_contents($certDir . 'sp.crt') : '';
$spKey    = is_file($certDir . 'sp.key') ? file_get_contents($certDir . 'sp.key') : '';

return [
    'strict'  => true,
    'debug'   => false,
    'baseurl' => $base . '/',

    'sp' => [
        'entityId' => $base . '/saml/metadata',
        'assertionConsumerService' => [
            'url'     => $base . '/saml/acs',
            // 'url'     => 'https://venbait.in/nhance/app/dev/#/login',
            'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
        ],
        'singleLogoutService' => [
            'url'     => $base . '/saml/slo',
            'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
        ],
        'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
        'x509cert'     => $spCert,
        'privateKey'   => $spKey,
    ],

    // Placeholder IdP (must pass Settings validation; replaced before Auth by DB row)
    'idp' => [
        'entityId' => $base . '/saml/placeholder-idp',
        'singleSignOnService' => [
            'url' => $base . '/saml/placeholder-sso',
        ],
        'singleLogoutService' => [
            'url' => '',
        ],
        'x509cert' => $spCert,
    ],
];